> ## Documentation Index
> Fetch the complete documentation index at: https://docs.costgraph.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Approvals

> Review the exact change a workflow proposes, approve or reject it, and unblock a run that needs access

When a workflow is ready to change something, the run stops and waits for an
admin or organization owner. The run shows **Needs you** on the **Overview**
tab and on its own page until someone answers. Other members see the request
but can't answer it.

## What you see

The approval card shows the change as one line, such as the resource and its
new size, followed by:

* **Expected impact**: the estimated saving or increase, or **Not estimated**.
* **Risk**: **Low**, **Medium**, or **High**. See [Risk](#risk).
* **Changes**: the resource or record the change touches, and how many more.

Click **See details** for the rest of the preview:

| Section | What it lists |
| - | - |
| **What will change** | Every resource or record the change touches |
| **Checked before it acts** | What CostGraph confirms right before it applies the change, such as the resource's current state |
| **How it confirms the result** | How CostGraph checks the change took effect |
| **If something goes wrong** | What happens if the change fails, and whether it's undone automatically |
| **Estimated impact** | The estimated effect on spend |

For a pull request, the card shows its title, the repository, whether it opens
as a draft, and the instructions the repository agent follows.

## Approve or reject

* Click **Approve change**, or **Approve pull request**, to let it happen.
  CostGraph applies exactly the change you saw, once, then checks that it took
  effect and records the result on the run.
* Click **Reject**, optionally tell the agent why under **Tell the agent
  why**, then click **Reject change**. Nothing changes, and the agent reads
  your reason before it continues.

If a check fails when CostGraph acts, for example because someone deleted the
budget, nothing changes and the run reports it.

## Questions

The agent can also ask a question, or ask you to choose between options.
Select an option, or write an answer and click **Send answer**. Only admins and
organization owners can answer.

## Expiry

An approval request expires after 24 hours without a decision. The change
isn't applied, and the agent carries on without it. A question expires after
seven days. To try an expired change again, retry the run.

## Risk

Every change has a risk level based on what it touches and whether it can be
undone. The following table lists the level for each kind of change:

| Risk | Changes |
| - | - |
| **Low** | Create, edit, or duplicate a report |
| **Medium** | Create or update a budget, share a report, open a pull request |
| **High** | Split rules, prices, virtual machine tags, report schedules, tickets, cloud changes, tagging rules, billing exports, and every delete |

A change can be rated higher than its kind, never lower.

## Changes that always need approval

Deletes, and every other change that can't be undone, always wait for a
person. These include deleting a budget, report, report schedule, or split
rule. They also include applying tagging rules, billing export changes, and
AWS cleanup such as deleting a volume.

## Tag exclusions

A goal's tag exclusions block any change to a resource that carries an
excluded tag. If CostGraph can't confirm a resource's tags, the change waits
for your approval instead.

## Needs access

A run shows **Needs access** when a connected tool stops working mid-run, for
example because a credential expired or a role lacks a permission. The step
that hit the problem changed nothing.

<Steps>
  <Step title="Fix the access">
    Follow the instructions on the card. Click the reconnect or settings link
    for the tool, and fix the connection or permission there.
  </Step>

  <Step title="Check access again">
    Return to the run and click **Check access again**. The run continues from
    where it stopped.
  </Step>
</Steps>

An access request also expires after 24 hours. After that, retry the run to
start again.

## Next steps

<CardGroup cols={2}>
  <Card title="What workflows can change" icon="list-check" href="/costgraph/workflows/what-workflows-can-change">
    Every change a workflow can make.
  </Card>

  <Card title="Goals and runs" icon="bullseye" href="/costgraph/workflows/goals-and-runs">
    Create a goal and follow its runs.
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.