Review and decide command approvals
Inspect a pending command or remediation request, make an eligible approval decision, and follow its separate execution result.
Before you start
- Use the organization containing the pending request and an MFA-verified session.
- An administrator other than the requester is normally needed for approval.
Screenshots show the Rapport interface with example data. Use your organization’s devices and values. Select an image to view it at full size.
Locate the pending request
Open Approvals. Use Commands awaiting approval for scripts, test runs, scheduled work, batches, and privileged commands. Use Remediations awaiting approval for automated fixes, where the alert and pack provide the necessary context. Read the request time, device, origin, and grouping.
What you should see: You have the correct request and its target device, rather than only a batch-level summary.
Review the actual change and requester
Inspect the command or script name, target, requester, and resolved action details shown for the request. For remediation, review the pack and triggering alert. Open the linked device or batch if you need more context. Check whether the work is a test run, scheduled task, or manual dispatch.
Approve or reject as an eligible reviewer
Choose Approve to allow the displayed request or Reject to refuse it. Complete a fresh second-factor check if prompted. The server rechecks the current role, command state, requester, content-author separation, and policy when accepting the decision.
| Field or control | What to do |
|---|---|
| Approve | Available for an eligible request reviewed by someone other than its requester, subject to policy. |
| Reject | Refuses the pending request. Read the updated status to confirm the decision. |
| Break glass… | Shown for an owner’s own request only when allowed by tenant policy; requires a written reason that is recorded and audited. |
What you should see: The decision is recorded and the job can progress or is rejected.
Handle expired or unreviewable requests
Do not approve a request whose requester or linked command cannot be verified. Use the source panel’s refresh action to reload current details and policy. Expired requests cannot be approved; where shown, Reject can close the pending item. Ask the requester to submit a new, current request if the work is still needed.
Follow execution after approval
Open the linked batch or device Commands tab to follow pickup, completion, output, and exit status. Use Decided commands by request time and Remediation activity by request time to inspect recorded decisions and results. These histories are ordered by request time, not by decision or completion time.
What you should see: You can distinguish the reviewer’s decision, agent execution, and any later recovery evidence.
If something doesn’t work
I cannot approve my own request.
Have a second eligible administrator review it. Only an owner with the enabled Break glass policy can use the audited self-approval path.
Approve disappears or a decision is rejected.
Reload the request. It may have expired, changed state, been decided elsewhere, or failed current policy checks.
Approved work is still pending.
Check the device connection, delivery state, and command result in Activity or Commands. Approval grants permission; the agent still has to receive and execute the job.