Managing Approvals
The approvals queue at /approvals lists every package install that’s
waiting on a human decision — because it was blocked by policy, or because
an agent’s askable block filed a request automatically.
Approving here does not grant a one-off exception. It writes an
endorsement — the package, a version range, and your justification as the
reason — into your org’s org-endorsements pack, exactly as if you had
added the entry yourself from Org Policy. The next
agent or person that hits the same package reads that decision instead of
re-triggering the same approval. Reviewing this queue is curating your org’s
standard library of endorsed packages one decision at a time, not clearing
a backlog of exceptions.
Pending
Section titled “Pending”Each pending approval shows the package name and version, its Trust and Threat scores, and the signals that drove the decision. Three actions are available:
- Approve — writes the endorsement described above. Approving a version outside an existing endorsement’s range widens that range rather than creating a second, conflicting entry for the same package — endorsements compound instead of piling up as one-off exceptions.
- Approve 24h — writes the same endorsement, but the approval itself expires in 24 hours, useful when you want to unblock someone right now without committing to a standing endorsement.
- Deny — rejects the request; the package stays blocked.
Approve always writes a plain endorsement — it never satisfies a security block, only a policy block. A request that’s still blocked after approving is blocked by malware or a block pack: overriding that requires the ceremony described in Overrides — a permitting role, a written reason, and a mandatory expiry — written directly on Org Policy, not from this queue.
Recently Resolved
Section titled “Recently Resolved”The last 10 resolved approvals are shown read-only underneath the pending section, so you can see what was decided without leaving the page.
Where approval requests come from
Section titled “Where approval requests come from”- A human hits a blocked install and requests an exception (via the CLI, the dashboard, or asking in Slack).
- An agent’s install is blocked but the block is “askable” — pkgPlease files the request automatically. See Registry & Tokens for how that flow works end-to-end.
To change what triggers a block in the first place, see Configuring Org Policy.