Approval Workflows
Approval is the separation-of-duties gate between authorship and execution. It binds a human sign-off to an exact content hash, enforces four-eyes review, supports revise-and-resubmit, and records every transition in the tamper-evident audit log. Professional adds the Decision Flight Recorder for point-in-time schema evidence.
State Machine
| State | Meaning | Transitioned by | Next |
|---|---|---|---|
| Draft | Authored/edited, not submitted. | Author | Pending (Request Approval) |
| Pending | Submitted; awaiting review. | Author | Approved | Rejected |
| Approved | Reviewed; eligible to execute / join a release. | Reviewer | Executed; or Draft (admin revoke / content edit) |
| Rejected | Reviewed and refused, with comment. | Reviewer | Pending (Resubmit after edit) |
| Executed | Successfully deployed. | System | Terminal |
Requesting Approval
From a Draft script, Request Approval moves it to Pending and disables the control (the button reads "Approval Pending"). A given version cannot be submitted twice; to change it, edit, which resets to Draft and bumps the version, then resubmit.
Review
Reviewers and Admins act on Pending scripts, evaluating content, properties (dialect, tags, dependencies), and version history, then Approve (becomes eligible for execution) or Reject with a required comment. Substantive review dimensions:
- Correctness, content matches stated intent.
- Blast radius, destructive operations (DROP/DELETE/TRUNCATE) guarded; see Blast Radius.
- Idempotency, safe under re-execution.
- Lock/latency profile, long ALTERs on hot tables are outage risks.
- Dependency correctness, predecessors declared for referenced objects.
- Reversibility, a defined undo path.
Revise and Resubmit
A rejected script surfaces the reviewer's comment; the author edits (version increments), then Resubmit for Approval returns it to Pending and opens a fresh cycle, the incremented version signaling the resubmission to reviewers. Cycles are unbounded until approval or abandonment.
Revocation
Admins can revoke a granted approval, resetting the script to Draft and forcing a new request before execution. Use when a requirement changes, a defect surfaces, the target schema drifts post-approval, or approval was granted in error.
Hash-Bound Approval (Auto-Reset on Edit)
Approval is pinned to the content hash. Any content edit recomputes the hash; a mismatch against the approved hash automatically invalidates the approval and resets to Draft. This structurally guarantees the executed bytes equal the reviewed bytes, there is no path to deploy content that diverged from what was signed.
Approval Audit Trail
Every action is appended immutably, request, approve, reject (with comment), resubmit (with new version), revoke, each capturing actor, timestamp, script, and version. This is a complete, tamper-evident review record for compliance.
Decision Flight Recorder
The Decision Flight Recorder captures point-in-time, read-only evidence of the target's structure at the moments that define an approval, so reviewers and auditors can see exactly what the database looked like at request and at sign-off. Snapshots record schema and statistics only, never row data or credentials. (Professional.)
Capture Triggers
- Requested, the baseline the reviewer evaluates.
- Signature, state at sign-off, exposing any drift since the request.
Capture runs in the background after the approval action commits and never blocks or fails it; an incomplete collector yields a partial or failed snapshot with a reason rather than a lost record.
Snapshot Contents
| Section | Content |
|---|---|
| Schema | Introspected tables, views, materialized views, functions, procedures, sequences per schema. |
| Data Shape | Per-touched-object estimated row counts and on-disk size; per-column null fraction and distinct ratios. No row values read. |
| Dependency Impact | Count of dependent objects/relationships around the change, from the dependency graph. |
| Capture Status | Complete, Partial (collector skipped), or Failed, with the specific collector and message. |
Viewing & Diffing
Approvals with evidence show a Snapshots badge (its tooltip flags partial/failed captures); opening the Flight Recorder panel lists every capture with metadata, issues, touched objects, data shape, dependency impact, and a per-schema summary. Any two captures for the same approval can be diffed: the panel computes a schema diff reporting added / removed / altered per object class, e.g. a column that appeared between request and signature, always ordered oldest-to-newest.