Approval Controls
Require human authorisation for high-impact changes with a clear, auditable trail.
BeginnerApproval ControlsGovernance
Where it fits in the lifecycle
- Plan
- Code
- Build
- Test
- Release
- Deploy
- Operate
- Monitor
- Release Approval controls, artefact promotion and provenance.
- Deploy Policy enforcement, admission control and infrastructure security.
Overview
Protected environments require a named approver before a deployment job runs, producing an audit record linking change, approver and time.
Why it matters
Separation of duties is a common regulatory requirement and a practical guard against a single compromised account shipping to production.
How it works
- 01Production is defined as a protected environment.
- 02Deployment jobs pause pending approval from a designated group.
- 03Approval events are logged with actor and timestamp.
Common tools
GitHubGitLabAnsible Automation PlatformGitHubGitLabAAP
Implementation examples
yamlManual production gate
deploy_prod: stage: deploy environment: name: production when: manual allow_failure: false rules: - if: $CI_COMMIT_BRANCH == "main"Best practices
- Approve on evidence, not on trust.
- Exclude the change author from the approver set.
Common mistakes
- Approvals that are always granted, providing paperwork without control.