Approvals

Some changes cannot be taken back: removing a person, purging a message from every mailbox, lifting a legal hold. An organisation can decide that each of them waits until a second administrator approves it, so that neither one administrator’s mistake nor one stolen administrator’s sign-in is enough. An organisation hosted on somebody else’s server can also have that server’s operator ask before reading or changing anything of its own.

The examples use the vsx shell function from the Quick start.

Choosing what waits

On the console, open Settings. The Approvals card lists each action with the choices Happens at once and Needs a second administrator.

From the command line:

vsx admin org approvals purge required
vsx admin org approvals remove-account required
vsx admin org approvals purge off

An approval needs a second administrator, so an organisation with only one cannot turn approvals on; the console says to add another administrator first. While any approval is required, turning one off waits for approval too.

One change always waits, whatever is chosen here: giving somebody the discovery right, which lets them search, open and export other people’s mail for a legal case. Saving a custom role that gains it, giving a person such a role, or making somebody eligible to take one waits for a second administrator, and an organisation with only one administrator cannot give it at all. Taking the right away never waits. The built-in Auditor role has the right as before.

When a change waits

A change that needs approval asks for a reason. On the console, the change asks why before it is sent. From the command line, add --reason:

vsx admin people status removed ada@example.com --reason 'Left in June, mail handed to Bob'

Before the request is kept, the server tries it without keeping anything. A request that would be refused is refused at once, as it would be without approvals. One that would work waits, and the command says so and gives its number:

waiting for approval, id 17: nothing happens until another of the organisation's administrators approves it with `versealx-server admin approvals approve 17 --reason '…'`, and it expires in 72 hours.

Nothing after it runs until it is decided. A request nobody decides within 72 hours expires.

Deciding

On the console, Approvals lists every request, newest first. A request’s page shows who asked and why, when it expires, and exactly what it would change, before and after. The organisation’s administrators see Approve… and Refuse…, and each asks for a reason. Whoever asked sees Withdraw… instead. The Overview lists what is waiting.

From the command line:

vsx admin approvals list
vsx admin approvals show 17
vsx admin approvals approve 17 --reason 'Checked with HR'
vsx admin approvals refuse 17 --reason 'Not before the handover'

Who can decide:

• Only the organisation’s own administrators can approve or refuse, each signed in as themselves.
• Nobody approves their own request. Whoever asked can refuse it, which withdraws it.
• The server’s operator never decides an organisation’s approvals.
• Two administrators deciding at once decide it only once.

An approved request runs as whoever asked, through every check it would have met without approvals. If what it would change has changed since it was asked, it is not run: it waits again, showing the new before and after. It also does not run if whoever asked has lost the role that let them ask.

Every request and every decision is in the audit log. The change itself is logged with both names: whoever asked and whoever approved.

The server’s operator

Where one server hosts several organisations, the server’s operator can read and change any of them. The server’s operator, in the same Approvals card, chooses whether they ask first:

vsx admin org operator-access ask

When the organisation asks first, the operator asks with a reason, and one of the organisation’s administrators approves or refuses it as above:

vsx admin approvals ask --reason 'Support case 4411: mail stuck since Monday'

The operator can still see that the organisation exists and what it uses. Exporting the organisation with versealx-server tenant export waits for an approved request to read made in the last eight hours.

In an emergency the operator can go ahead without waiting by giving --emergency 'why'. The request is kept as an emergency and recorded, and the organisation’s administrators are told at once.

The operator runs the server and holds its storage. Asking first makes the operator’s access through Nixt Server something the organisation grants and can read about afterwards; it is a record and an agreement, not a lock against whoever holds the machine.

Being told

The alerts have an Approvals kind, on by default for the organisation’s administrators. It tells of each request that starts waiting, and of each emergency the operator declares.

Over the API

A change that needs approval takes a reason query parameter. Without one, it is answered 428 Precondition Required. With one, it is answered 202 Accepted with waitingForApproval: true and the approval.