Approvals

Iris never changes your plant or your project by itself. When any part of it wants a change, it files a proposal and stops. The change happens only when a person approves that proposal, and that person must already be allowed to make the change by hand.

This page is for whoever reviews proposals, and for administrators deciding who can.

Where proposals appear

• ConfigHub › Security › Iris Proposals, the full list.
• Studio › View › Iris Proposals, a dock beside the project panel.
• A card in the chat that raised it (the Studio dock and operator chat).

A proposal is one of two kinds:

Kind	What it changes
Tag write	One tag, to one value.
Project change	One existing file in a project (a screen, script or named query), or a new one of those.

Each shows what it would change, the reason Iris gave, who or what raised it (a person; key:<name> for an MCP key; agent:<name>; or script:gateway/<script>), the model and tokens used, and a link to the conversation. The reason is labeled unverified: it is the model's text and was written without anyone checking it, so read the change itself, not the reason.

Approving one

1. Open the proposal. For a project file you see the current text beside the proposed text, and the change as a diff.
2. Click Approve. Nexus runs a dry run and shows This will change: with the exact old and new value.
3. Click Approve and apply. If your gateway requires e-signatures, you also type your password.

Or click Reject, with a reason. Nobody is notified automatically; the proposer sees the state when they next look.

You see Approve only if you could approve it. That takes two things, checked when you click and against your role now, not the proposer's:

	You need
Always	AI approve (AiApprove)
A tag write	Write tags (TagWrite), or Write admin tags (AdminTagWrite) for a tag marked admin-level
A project change	Designer access (DesignerAccess)

A role with only AI approve cannot approve anything, and a role that can write tags but lacks AI approve cannot approve a tag write. A person with both can approve a proposal they raised themselves; the audit row names the proposer and the approver separately so that is visible. (A one-person gateway has no one else.)

What happens when you approve

Before applying, Nexus checks again, live. It refuses and says why if:

• the tag no longer exists, its quality is bad, or the value is not valid for it;
• the file changed since it was proposed, or holds uncommitted work, so the proposal is out of date;
• a file proposed as new now exists;
• the proposal expired (15 minutes by default, set under Change proposals), or AI may propose tag writes was switched off.

Then it applies:

• A tag write goes through the same write path a hand write uses, so the per-tag write limits and the audit entry (with old and new value) all apply.
• A project change is committed to the project's source control as just that file, authored by the approver, with Proposed-by, Approved-by and Iris-Proposal lines in the commit message. Other unsaved work is never swept in.

If Require e-signature to approve AI changes is on and the Advanced Security module is licensed, the approval is signed with the approver's password and recorded in the tamper-evident signature chain.

Undoing one

• A project change: on the approved proposal, click Restore previous version. It shows what will change and, on confirmation, puts the file back to the version before the AI change through source control (Source control permission needed). A new file is removed. Commit the restore to keep it.
• A tag write: a physical write cannot be taken back, so click Propose the old value. That files a new proposal for the previous value, which a person approves like any other.

Limits

• Up to 200 proposals can be waiting at once, and 25 per proposer. Beyond that the proposing tool answers that the queue is full.
• A pending proposal is never deleted for age. A decided one is kept as long as transcripts are.
• Tools that file proposals exist only while the gateway's tag access is restricted. See Turning Iris on.