Assign review responsibility
The supported role baseline separates ApprovalAdmin from PlatformAdmin. A reviewer needs approval capability and relevant context; routine review does not require handing out general platform administration.
Review intent and feasibility
Read service ownership and workload requirements, then confirm compatible cluster and storage placement. Detected capabilities and administrative policy are different checks. The submitted namespace remains immutable during review.
Keep the decision and outcome distinct
The ticket contract distinguishes PENDING, APPROVED, EXECUTING, SUCCESS and FAILED, with rejected and cancelled outcomes too. A rejection is a review decision; execution can fail later. Audit filters help users with audit access inspect the recorded activity.
Walk through the task
Open the intended task
Use an account assigned to built-in review and confirm the operation and requester context.
Read approval role separationCheck workload and placement
Read the reason, owning service, namespace, template and size. For a create request, choose eligible cluster and storage settings; resolve validation failures first.
Read capability and policy validationRecord the decision
Approve through the decision action, or reject with a useful reason. Namespace correction requires resolving the request, not a placement override.
Inspect built-in decision contractsFollow execution and evidence
Inspect the ticket outcome and resulting VM after approval. With audit access, review request, decision and resource-change records.
Requirements and limits
- This guide covers built-in approval; external integrations have separate configuration and server-to-server contracts.
- Approval does not guarantee storage provisioning, admission or guest startup.
- Power and console operations follow environment-aware policy, not one mandatory review path in every environment.
Documentation and implementation
- Request and review split
Submitted inputs and reviewer-controlled placement.
- Built-in task and audit API
Decision endpoints, ticket statuses and /audit-logs.
- Approval role baseline
ApprovalAdmin and platform administration are distinct.
- Cluster policy validation
Capability checks followed by explicit administrative policy.
Common questions
Can I fix the namespace while approving?
No. The submitted namespace is immutable. Resolve it with the requester rather than using placement to move the request.
How do rejection and failure differ?
REJECTED records a decision. FAILED is a workflow outcome. Inspect ticket details, the resulting VM and authorized audit records for execution context.