Skip to content
ReindeerReindeerReindeer docs

Approvals and the two-person rule

Actions that need approval

Section titled “Actions that need approval”
Action Requested by
New machine identity Admin
New person invite Admin
Passkey recovery Admin
Full or large export Reader or machine
Batch or large deletion Deleter or machine
Key loss declaration Admin
Organisation activation, lifting a suspension (platform) Operator

Who can decide

Section titled “Who can decide”

The decider cannot be:

  • the requester,
  • anyone who controls the requester (who requested their invite or issued its code),
  • anyone the requester controls,
  • anyone who shares a controller with the requester.

Control is followed through the whole chain and worked out again when the decision is made. A machine is controlled by whoever requested it and issued its bootstrap code.

The flow

Section titled “The flow”
  1. The request is created pending; one principal may have at most 50 pending requests at once.
  2. An eligible approver approves or rejects it after confirming with a passkey within the last five minutes.
  3. Some approvals (large deletions) enter a 24-hour cool-off, during which any approver may cancel them.
  4. An approved action runs once. Requests expire when nobody decides them within seven days.