> ## Documentation Index
> Fetch the complete documentation index at: https://docs.costgraph.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Approvals

> Review the exact change a workflow proposes, approve or reject it, and unblock a run that needs access

When a workflow is ready to change something, the run stops and waits for a
member of the tenant to answer. The run shows **Needs you** on the **Overview**
tab and on its own page until someone answers.

## What you see

The approval card shows the change as one line, such as the resource and its
new size, followed by:

* **Expected impact**: the estimated saving or increase, or **Not estimated**.
* **Risk**: **Low**, **Medium**, or **High**. See [Risk](#risk).
* **Changes**: the resource or record the change touches, and how many more.

Click **See details** for the rest of the preview:

| Section | What it lists |
| - | - |
| **What will change** | Every resource or record the change touches |
| **Checked before it acts** | What CostGraph confirms right before it applies the change, such as the resource's current state |
| **How it confirms the result** | How CostGraph checks the change took effect |
| **If something goes wrong** | What happens if the change fails, and whether it's undone automatically |
| **Estimated impact** | The estimated effect on spend |

For a pull request, the card shows its title, the repository, whether it opens
as a draft, and the instructions the repository agent follows.

## Approve or reject

* Click **Approve change**, or **Approve pull request**, to let it happen.
  CostGraph applies exactly the change you saw, once, then checks that it took
  effect and records the result on the run.
* Click **Reject**, optionally tell the agent why under **Tell the agent
  why**, then click **Reject change**. Nothing changes, and the agent reads
  your reason before it continues.

If a check fails when CostGraph acts, for example because someone deleted the
budget, nothing changes and the run reports it.

## Questions

The agent can also ask a question, or ask you to choose between options.
Select an option, or write an answer and click **Send answer**. Any member of
the tenant can answer.

## Expiry

An approval request expires after 24 hours without a decision. The change
isn't applied, and the agent carries on without it. A question expires after
seven days. To try an expired change again, retry the run.

## Allow any change

A goal set to **Allow any change** doesn't stop for approval on each change.
Changes run as the agent proposes them, until the run reaches the goal's
decision limit. After that, every change waits for you as usual.

Some changes still ask first, even under this setting:

* Deleting something CostGraph didn't create. The approval reads "CostGraph
  did not create this resource and does not manage it. Delete it from here?"
  This also applies when CostGraph can't confirm who created it.
* A change to a resource that carries one of the goal's
  [tag exclusions](#tag-exclusions).

Use it for goals you trust to work unattended. Every change is still recorded
on the run, with what changed and the result.

## Risk

Every change has a risk level based on what it touches and whether it can be
undone. The following table lists the level for each kind of change:

| Risk | Changes |
| - | - |
| **Low** | Create, edit, or duplicate a report |
| **Medium** | Create or update a budget, share a report, open a pull request |
| **High** | Split rules, prices, virtual machine tags, report schedules, tickets, cloud changes, tagging rules, billing exports, and every delete |

A change can be rated higher than its kind, never lower.

Changes in [connected services](/costgraph/workflows/what-workflows-can-change#connected-services)
are rated **High**. The approval shows the request, including the method, the
path with its values filled in, and the JSON body.

## Changes that always need approval

Deletes, and every other change that can't be undone, always wait for a
person. These include deleting a budget, report, report schedule, or split
rule. They also include applying tagging rules, billing export changes, and
AWS cleanup such as deleting a volume.

## Tag exclusions

A goal's tag exclusions block any change to a resource that carries an
excluded tag. If CostGraph can't confirm a resource's tags, the change waits
for your approval instead.

## Needs access

A run shows **Needs access** when a connected tool stops working mid-run, for
example because a credential expired or a role lacks a permission. The step
that hit the problem changed nothing.

<Steps>
  <Step title="Fix the access">
    Follow the instructions on the card. Click the reconnect or settings link
    for the tool, and fix the connection or permission there.
  </Step>

  <Step title="Check access again">
    Return to the run and click **Check access again**. The run continues from
    where it stopped.
  </Step>
</Steps>

An access request also expires after 24 hours. After that, retry the run to
start again.

## Next steps

<CardGroup cols={2}>
  <Card title="What workflows can change" icon="list-check" href="/costgraph/workflows/what-workflows-can-change">
    Every change a workflow can make.
  </Card>

  <Card title="Goals and runs" icon="bullseye" href="/costgraph/workflows/goals-and-runs">
    Create a goal and follow its runs.
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.