# Approvals with MFA

> An approval is a person's sign-off on one exact, frozen version of something, given with two-step verification.

An **approval** is a person's sign-off on one exact version of something: a record, a set of changes, or a [release](/concepts/releases/) of a publication. CapZero freezes what you're asked to approve, so you approve exactly what you read. Approving needs [two-step verification](/reference/glossary/#two-step-verification), also called MFA: a passkey or a code from an authenticator app, as well as your sign-in.

## Why it works this way

Some decisions have consequences outside the app, such as publishing a document or changing an adopted budget. CapZero makes sure a real, accountable person makes them:

- **A person, never an agent.** Only people approve. An agent can ask for an approval, but it can't give one, whatever permissions it has.
- **Two-step verification.** Your browser session must be verified with your passkey or authenticator app, so a stolen password alone can't approve anything.
- **Never your own request.** The person who asked for an approval can read it but can't answer it. Someone else always checks the work.
- **Bound to what was frozen.** An approval holds only for the version it froze. If that version changes, the approval no longer counts, and someone asks again.
- **Recorded.** Every request and every answer, with its note, is kept in the history.

## How it relates to what you do

### Finding approvals that wait for you

Approvals you can answer are under **Needs your decision** on **Home**, with the one due soonest first. The thing being approved also links to its approval: a release, for example, has **Open the approval**.

### Answering one

The approval page shows what was frozen, how many **Approvers** it needs, and its **Activity**.

1. Read what was frozen.
2. Choose **Approve** or **Reject**. To reject, add a **Note** that says what has to change, so the person who asked knows.
3. Choose **Send decision**.

The page then shows **Approved** or **Rejected** with your name. Once enough people approve, the work it holds up can go ahead.

### When you can't answer it

The page says **You can read this approval but not answer it**, and why:

| The page says | Why | What to do |
|---|---|---|
| **You asked for it, so someone else approves it.** | You asked for this approval. | Ask a colleague who may approve to answer it. |
| **Approving needs MFA. Sign in with your passkey or authenticator app, then come back.** | Your session isn't verified with two-step verification. | Open your account menu at the bottom of the rail and choose **Two-step verification**. Confirm it's you, or set it up if you haven't. Then come back to the approval. |
| **Approving needs** followed by a permission's name | You don't hold the permission this approval needs. | Ask your administrator. Only people can be given it. |
| **You've answered it; it waits for the other approvers.** | It needs more than one approver. | Nothing: it goes ahead once the others approve. |

### When it no longer holds

- **No longer holds**: what it froze changed after the request, so the approval doesn't count. The page says what changed. The person who asked freezes the new version and asks again.
- **Withdrawn**: the person who asked took the request back. It takes no answer.
- **This approval changed while you were deciding. Nothing was sent.**: someone else answered, or it changed, while you were reading. Read it again. Your choice and note are kept.

A release never changes once it's built, so its approval always holds. Instead, publishing checks the release against the live data, and refuses if anything changed. See [Releases](/concepts/releases/#when-publishing-is-refused).

## Related

- [Releases](/concepts/releases/)
- [Approval](/reference/glossary/#approval) and [Two-step verification](/reference/glossary/#two-step-verification) in the glossary