Notifications
How notifications reach you in the topbar and the Notifications hub, how to act on approvals and replies inline, and how watch levels and channel preferences control what you receive.
Chat
How the CentraKit AI assistant works in the Chats page and side panel, including Ask, Plan and Agent modes, models, attachments, commands, approvals, agent runs, sharing, contextual actions, knowledge retrieval and organization AI settings.
Notifications
How notifications reach you in the topbar and the Notifications hub, how to act on approvals and replies inline, and how watch levels and channel preferences control what you receive.
Chat
How the CentraKit AI assistant works in the Chats page and side panel, including Ask, Plan and Agent modes, models, attachments, commands, approvals, agent runs, sharing, contextual actions, knowledge retrieval and organization AI settings.
How approval rules make risky actions by people, AI agents, workflows, MCP clients and API keys wait for a human decision, and how approvers decide, escalate and expire requests.
Approvals put a human checkpoint in front of risky actions. When an action matches an approval rule, CentraKit records an approval request and the action waits until someone confirms or approves it.
Approval rules are managed on the Approval rules tab of Roles & Permissions at /{orgSlug}/roles/approval-rules. Requests are decided from Notifications.
Approvals cover actions from every source: the assistant, workflows, MCP clients, API keys and people in the app. Requests for time off, timesheets and expenses use the same requests but have their own review flow in People, Time and Expenses.
Every gated action has a key, such as quote.send, and a risk level of low, medium, high or critical. Actions are also tagged with effects that describe why they are risky:
| Effect | Example |
|---|---|
| Customer-facing | Sending a quote to a customer. |
| Moves money | Writing off an invoice. |
| Destructive | Deleting or archiving records. |
| Changes access | Inviting users or changing roles. |
| Calls an outside system | Sending data to an integration. |
| Bulk change | Updating many records at once. |
A rule can target one action, every action with an effect, or any action.
A rule has these parts:
| Field | Meaning |
|---|---|
| Name and Description | How the rule appears in the list and to approvers. |
| Action | One action, or Any action. |
| Effect | One effect, or Any effect. |
| Who is acting | People, AI agents, Workflows, MCP clients and API keys. Selecting none means everyone. |
| Only when | Up to ten conditions on the action input, such as input.quantity more than 50. Operators are equals, is not, more than, at least, less than, at most, is one of, contains and is set. |
| Requires | Someone else approves, or The requester confirms. |
| Approvers | Anyone allowed to do the action, or holders of a chosen permission. |
| Approval mode | Any approver, Every approver or In order. |
| Approvals needed | The quorum, from 1 to 10. |
| Expires after (hours) | The request expires if nobody decides in time. |
| Escalate after (hours) and Escalate to | Who is notified when the request is still open after that time. Set both or neither. |
| The requester may approve their own request | Allows self-approval. |
| Rule is active | Turns the rule on or off without deleting it. |
Platform administrators can set rules that apply to every organization. They appear in the list with a lock and the note "Set by the platform. Organizations can add stricter rules but not remove this one." Organization rules can only add approvals, never remove one that the platform requires. See Roles and permissions.
A request records the action, who asked for it and from where (the assistant, a workflow, an MCP client, the app or the API), and an explanation of the intent, the impact, the data it touches and how to roll it back.
| Status | Meaning |
|---|---|
| Requested | Waiting for a decision. |
| Approved | Approved and ready to run once. |
| Denied | Refused. The action does not run. |
| Expired | Nobody decided before the deadline. |
| Superseded or Canceled | Replaced by a newer request or withdrawn. |
| Consumed | The approved action ran. |
An approval is tied to the exact input that was requested. If the input changes, the action needs a new approval. Records that wait on a request show Awaiting approval, Approved or Approval denied in their progress bar.
Besides AI and workflow actions, these domain actions check approval rules:
When the organization has no rules yet, the tab shows "No approval rules yet". Risky AI actions still ask the requester for confirmation without a rule. Add a rule to require a second person.
Use the row actions Edit rule and Delete rule. To pause a rule, turn off Rule is active. Deleting a rule means actions it covers no longer wait for approval.
Approvers get an approval notification in the topbar and in the Notifications hub. Select Approve or Deny on the row. When a rule needs more than one approver, the toast reads "Decision recorded; more approvals are needed" until the quorum is met.
For actions started in the app, through the API or from an MCP client, run the action again with the same input after it is approved. The assistant and workflows continue on their own.
A scheduled job runs every ten minutes. It notifies the escalation target for requests that passed their escalation time and marks requests as expired when they pass their expiry time. The requester is notified of the outcome.
| Permission | Allows |
|---|---|
organization.approvals.manage | Create, edit and delete the organization's approval rules. |
system.approvals.manage | Manage platform rules in Admin. |
Deciding a request needs the approver permission set on the rule. By default that is the permission of the action itself.
APPROVAL_REQUIRED error with the approvalId when a tool call needs approval. Confirm the request in Notifications or wait for the approver, then call the same tool again with the same input. See MCP.REST calls that hit an approval rule return 409 with the APPROVAL_REQUIRED code and an approvalId extension. Retry the same request after approval. See Errors.
GET and POST /api/v1/organizations/{organizationId}/approvals list and decide pending time off, timesheet and expense requests. They do not cover approval rules or other approval requests.
Not yet available: REST endpoints for approval rules and general approval requests.
Last updated on
Notifications
How notifications reach you in the topbar and the Notifications hub, how to act on approvals and replies inline, and how watch levels and channel preferences control what you receive.
Chat
How the CentraKit AI assistant works in the Chats page and side panel, including Ask, Plan and Agent modes, models, attachments, commands, approvals, agent runs, sharing, contextual actions, knowledge retrieval and organization AI settings.