Approvals and governance
Every change has an owner and a second pair of eyes.
ACSE never decides for you. A security approver reviews what the fix will do, what is not known and how to undo it, then decides with step-up MFA. The decision is bound to the exact view they approved.
Decisions that hold up
Each approval records who decided, what they saw and when, in a form nobody can quietly change later.
Separation of duties, built in
By default, whoever drafted or requested a change cannot approve it. Small teams can allow it only with a written justification, which goes on the record.
Clear choices, not just yes or no
Approve, request changes, mark invalid, defer, request an exception or escalate, each with its reason on the record.
What the approver sees
The whole picture before anyone says yes
- What will changeThe exact pull request at its exact commit, and the known blast radius.
- What is not knownUnresolved dependencies and residual uncertainty, each of which must be acknowledged to approve.
- How to undo itThe recovery plan, and the observation window during which ACSE watches the result.
- A fresh viewIf anything changed since the page loaded, nothing is recorded and the approver reloads the case.
Governance in practice
Rules your auditors expect
Step-up MFA on every decision
Approvals, exceptions and anything that changes a report ask for a fresh second factor.
Exceptions that expire
Accepted risk names an owner, has an end date and keeps its severity. Critical ones need a compensating control.
Loosening needs two
Weakening a policy, a time limit or an AI setting needs a second person. Strengthening applies at once.
Seven roles
Tenant admin, security approver, security engineer, cloud engineer, risk owner, auditor and service account.
Timing and limits
Fix-by targets, exception limits and observation windows come from settings, versioned and on the record.
Fail closed
If the approval or verification service is unavailable, the answer is no. Silence is never consent.
The rule
By default, nobody approves a change they wrote, requested or helped draft.
Where policy requires it, a second person must approve too. Every exception to the rule is justified and recorded.
Questions
What people ask us
Can a fix be approved from a phone?
Approvals happen in the ACSE portal with step-up MFA through your identity provider. A dedicated phone approval flow is planned.
What if we only have one administrator?
A change that loosens a control waits 24 hours, notifies everyone and can be cancelled. Accepting risk always needs a second person.
Keep reading
Related
Evidence
ACSE records every step of every fix in a signed, hash-chained, append-only record in your own account, which an auditor can verify offline.
ReadSolutionsRisk and compliance
ACSE lets risk and compliance teams accept risk on purpose, with owners and expiry dates, track fix-by targets and adopt framework versions with two people.
ReadACSETrust center
How ACSE keeps your data in your account, connects read-only with no keys, keeps people in charge of every change and leaves proof you can check yourself.
ReadTalk to us
See ACSE on your cloud.
Tell us what you run and what your auditors ask for. We’ll show you the loop end to end: a real finding, a fix as code, an approval with MFA and the sealed record.