> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mithunai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Approval rules: Always allow, two people, never allowed

> Let one kind of AI employee action run without asking, make another need two people, and see who changed what. Money, deletes and access always ask.

Your [approval policy](https://docs.mithunai.com/team/approval-policy.md) says which kinds of action wait for a person. **Approval
rules** go one step further, for one employee, one tool and one kind of action at a time:

* **Always allow** -- this employee does this kind of action without asking.
* **Two people must approve** -- a second, different person approves after the first.

A rule is never a blanket allow, and it is decided by the kind of action, never by what a ticket, an
alert or a document says.

> [!WARNING]
>
> Approval rules are in **beta**: new, and not yet tried on a live account. They are off unless your
> deployment has switched them on; until then the **Approval rules** panel is not shown, no card
> offers **Always allow**, and no rule applies -- two-people rules included.

## Always allow

On a waiting card, **Always allow** carries that action out and makes the rule in one step. The
employee's page lists the rule under **Approval rules**, with who added it and when, and **Revoke**
ends it.

**Never always allowed.** Anything that moves money, deletes, publishes or changes access always waits
for a person. No rule and no policy can change that, and the panel lists which of the employee's
actions it covers. Today that is preparing a payment; publishing an article, a social post or an SEO
change; and granting access, resetting a password or installing software. Kinds of action that always
need a person are not offered either.

Work that arrived by itself -- a [schedule](https://docs.mithunai.com/team/schedules-and-daily-summary.md), a Zendesk ticket or an
alert ([Work that arrives by itself](https://docs.mithunai.com/team/work-that-arrives-by-itself.md)) -- still waits for a person,
whatever a rule says. Nobody handed it over, so somebody has to decide.

## Two people

Under **Approval rules**, choose a kind of action and **Require two people**. From then on the first
approval leaves the card waiting, with *One person approved this*. A second, different person must
approve it. They see exactly what the first person approved and cannot change it; if anything changed
in between, it is not carried out. The same person approving twice is refused. Either person may
still deny it.

## Expiry

A card from work that arrived by itself shows **Expires** *in 20 hours*. If nobody decides in time
it becomes **Expired**, says *Nothing was sent*, and is never carried out. The time is a day unless
your deployment sets another (`MITHUNAI_AI_EMPLOYEES_BACKGROUND_APPROVAL_MINUTES`). Work you
handed over yourself does not expire.

## The record

Every request, edit, approval, denial, expiry and rule change is written to your organisation's audit
log with who and when. An employee's **What it has done** shows the steps on its work -- *Automatically,
by rule* for an expiry -- and **Approval rules** shows every rule added and revoked.

## Who can change rules

Owners and Administrators, signed in. Everyone who can see the employees can read the rules. An API
key can read them and never change them.

## Related

* [Approvals](https://docs.mithunai.com/team/approvals.md) -- reading and deciding a card.
* [Approval policy](https://docs.mithunai.com/team/approval-policy.md) -- which kinds of action wait for a person.
* API: [List](https://docs.mithunai.com/api-reference/employees/list-approval-rules.md), [set](https://docs.mithunai.com/api-reference/employees/set-approval-rule.md)
  and [revoke](https://docs.mithunai.com/api-reference/employees/revoke-approval-rule.md) approval rules.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.