Skip to content
CapZero Docs

Approvals with MFA

An approval is a person’s sign-off on one exact version of something: a record, a set of changes, or a release of a publication. CapZero freezes what you’re asked to approve, so you approve exactly what you read. Approving needs two-step verification, also called MFA: a passkey or a code from an authenticator app, as well as your sign-in.

Why it works this way

Section titled “Why it works this way”

Some decisions have consequences outside the app, such as publishing a document or changing an adopted budget. CapZero makes sure a real, accountable person makes them:

  • A person, never an agent. Only people approve. An agent can ask for an approval, but it can’t give one, whatever permissions it has.
  • Two-step verification. Your browser session must be verified with your passkey or authenticator app, so a stolen password alone can’t approve anything.
  • Never your own request. The person who asked for an approval can read it but can’t answer it. Someone else always checks the work.
  • Bound to what was frozen. An approval holds only for the version it froze. If that version changes, the approval no longer counts, and someone asks again.
  • Recorded. Every request and every answer, with its note, is kept in the history.

How it relates to what you do

Section titled “How it relates to what you do”

Finding approvals that wait for you

Section titled “Finding approvals that wait for you”

Approvals you can answer are under Needs your decision on Home, with the one due soonest first. The thing being approved also links to its approval: a release, for example, has Open the approval.

Answering one

Section titled “Answering one”

The approval page shows what was frozen, how many Approvers it needs, and its Activity.

  1. Read what was frozen.
  2. Choose Approve or Reject. To reject, add a Note that says what has to change, so the person who asked knows.
  3. Choose Send decision.

The page then shows Approved or Rejected with your name. Once enough people approve, the work it holds up can go ahead.

When you can’t answer it

Section titled “When you can’t answer it”

The page says You can read this approval but not answer it, and why:

The page says Why What to do
You asked for it, so someone else approves it. You asked for this approval. Ask a colleague who may approve to answer it.
Approving needs MFA. Sign in with your passkey or authenticator app, then come back. Your session isn’t verified with two-step verification. Open your account menu at the bottom of the rail and choose Two-step verification. Confirm it’s you, or set it up if you haven’t. Then come back to the approval.
Approving needs followed by a permission’s name You don’t hold the permission this approval needs. Ask your administrator. Only people can be given it.
You’ve answered it; it waits for the other approvers. It needs more than one approver. Nothing: it goes ahead once the others approve.

When it no longer holds

Section titled “When it no longer holds”
  • No longer holds: what it froze changed after the request, so the approval doesn’t count. The page says what changed. The person who asked freezes the new version and asks again.
  • Withdrawn: the person who asked took the request back. It takes no answer.
  • This approval changed while you were deciding. Nothing was sent.: someone else answered, or it changed, while you were reading. Read it again. Your choice and note are kept.

A release never changes once it’s built, so its approval always holds. Instead, publishing checks the release against the live data, and refuses if anything changed. See Releases.

Section titled “Related”