We keep giving agents more power over your governance: they can propose requirements, refine guardrails, and stand up scopes without you ever opening a browser. So what stops an agent (or an overconfident teammate) from quietly rewriting the rules? Approval workflows. You define, once, which changes need a human, and from then on the hold is deterministic: every matching change waits in a pending state until someone who satisfies your policy signs off, whether it came from the web console, the CLI, or an AI agent over MCP at 2am. There is no side door.
It's configurable down to the operation. Gate any of the governance operations independently (creates, updates, and deletes across requirements, guardrails, scopes, groups, and marketplace overrides), so you can require sign-off on deletes while new audit-mode requirements flow freely. Narrow the gate further with target selectors (only SOC2-tagged requirements, only enforced-mode changes), and compose each approval phase however your review works: "any Admin, OR the Security Auditor AND a Contributor," with phases in sequence for multi-stage sign-off. Even the approval configuration itself can require approval to change.
Reviewers approve evidence, not subject lines. The Approvals page opens straight to pending reviews and shows the exact proposed change: a before/after diff for edits, real names instead of identifiers, batch actions, and shareable links for a second opinion. Submitters get the truth too. A held change reports "pending approval," not "created," agents included, so nothing downstream believes it landed when it didn't. Gated deletes are soft-deletes, and every decision, comment, and vote lands in the audit log with attribution, which maps neatly onto SOC 2-style change management. Full details in the approval workflows docs.