Approval & WARN Handling

WARN means ASG has determined the action is high risk and requires human approval.

PASS → execution proceeds immediately.

WARN → execution pauses and creates a decision.

Approval → execution resumes.

Rejection → execution terminates.

BLOCK → execution is denied and never enters approval.

This page is a summary. The canonical approval model is in /docs/approval-flow.

WARN is immutable

Once ASG returns WARN for a decision, it stays WARN until an explicit approval action occurs.

Approval lives separately

Approval is a separate operation from validation. Validation returns a decision. Approval authorizes execution for WARN decisions.

Polling vs blocking behavior

When you receive WARN:

• you must not execute
• you must store decision_id
• you must store approval_token
• you must wait for approval

The waiting mechanism is your choice:

• Polling

- periodically check approval status

• Blocking (synchronous wait)

- wait for approval up to a timeout

A timeout is not approval. Errors are never approval.

Dashboard approval flow

A human reviewer approves or rejects a WARN decision in the dashboard.

Audit implications

A WARN decision is auditable because:

• the decision exists even if no action executes
• approval is recorded as a separate event
• approval comments and attribution are logged