Decisions

Approval Policies

An Approval Policy configures how a formal approval must happen. It is different from an organisational AI governance policy.

Two kinds of policy

AI governance policy: an organisational rule, such as "high-risk AI recommendations require human review". See Policies.
Approval Policy: workflow configuration, such as "deploying a high-risk AI System needs a Legal Reviewer and a Security Lead".

Scope: company-wide, or one project (New Project Policy).
When it applies: entity type, lifecycle action, minimum risk tier and jurisdiction. Entity types and actions are the same ones decision requests use: AI system, Vendor, Risk, Finding, Control, Playbook run, Regulatory update, Exception or Lifecycle stage; and Approve governance plan, Approve classification, Approve deployment, Accept residual risk, Sign off, Approve continued use, Approve retirement, Review evidence or Override a blocked stage. Each can also be Any, and the risk tier can be Any risk tier.
Rules: Requires evidence, Requires step-up and Separation required, plus Decision expiry (days) and Default due (days).
Steps: each has a Role, a mode, a quorum and whether it is mandatory. The Role list shows the roles people in your company hold, such as Company Admin and your own Access Control roles. To require another role, such as a DPO, create it in Access Control and assign it first.

A policy applies only when its entity type and lifecycle action exactly match the request (or the policy uses Any) and the record meets its minimum risk tier. A project policy applies only to its own project.
Override a blocked stage is requested automatically when someone overrides a lifecycle stage whose entry checks have not passed. Its risk tier is High, so it needs a matching Lifecycle stage policy.
A policy marked Retired entity type or action was saved with a value no decision request uses, so it never applied. It has been disabled; edit it to choose a supported value, then enable it.
If no policy matches, requests for High-risk or Prohibited (Unacceptable) systems are blocked, and requests for lower tiers do not need approval.
Decision expiry sets how long an approved decision stays valid before it moves to Review Required.

Last reviewed 2 October 2026

Decisions

An Approval Policy configures how a formal approval must happen. It is different from an organisational AI governance policy.

AI governance policy: an organisational rule, such as "high-risk AI recommendations require human review". See Policies.
Approval Policy: workflow configuration, such as "deploying a high-risk AI System needs a Legal Reviewer and a Security Lead".

Scope: company-wide, or one project (New Project Policy).
When it applies: entity type, lifecycle action, minimum risk tier and jurisdiction. Entity types and actions are the same ones decision requests use: AI system, Vendor, Risk, Finding, Control, Playbook run, Regulatory update, Exception or Lifecycle stage; and Approve governance plan, Approve classification, Approve deployment, Accept residual risk, Sign off, Approve continued use, Approve retirement, Review evidence or Override a blocked stage. Each can also be Any, and the risk tier can be Any risk tier.
Rules: Requires evidence, Requires step-up and Separation required, plus Decision expiry (days) and Default due (days).
Steps: each has a Role, a mode, a quorum and whether it is mandatory. The Role list shows the roles people in your company hold, such as Company Admin and your own Access Control roles. To require another role, such as a DPO, create it in Access Control and assign it first.

A policy applies only when its entity type and lifecycle action exactly match the request (or the policy uses Any) and the record meets its minimum risk tier. A project policy applies only to its own project.
Override a blocked stage is requested automatically when someone overrides a lifecycle stage whose entry checks have not passed. Its risk tier is High, so it needs a matching Lifecycle stage policy.
A policy marked Retired entity type or action was saved with a value no decision request uses, so it never applied. It has been disabled; edit it to choose a supported value, then enable it.
If no policy matches, requests for High-risk or Prohibited (Unacceptable) systems are blocked, and requests for lower tiers do not need approval.
Decision expiry sets how long an approved decision stays valid before it moves to Review Required.

Last reviewed 2 October 2026