# Approve a gated run

Resolve a run waiting at an approval gate, after checking what it would do and which plan revision you are approving.

Source: https://opafra.com/docs/running/approve-a-run

---

A run targeting a protected environment pauses before its first step and waits for a
person. This is how to resolve one.

## Before you begin

You need the **Operator** role or above. A Viewer cannot approve. If the environment is
also **protected**, you need an explicit grant on it as well.

## 1. Open the approvals inbox

Open **Approvals**. Every run waiting on a decision you are entitled to make is listed,
with its plan, the environments it touches, and who started it.

## 2. Check what the run would do

Do not approve from the plan name. Open the plan and read the steps, then dry run it if
one has not already been run against these targets.

```text title="dry run, before approving"
Step 2  Deploy the site config    template.deploy
  web-01   no change
  web-02   would change   /etc/nginx/sites-enabled/app.conf   +4 -2
```

That tells you which hosts the run actually touches. See
[dry runs](/docs/running/dry-run) for what a preview does and does not prove.

## 3. Check the revision

The approval names the plan revision it was requested against. If the plan has been
edited since, Opafra shows that the revision moved rather than blocking the decision.

> **Warning**
>
> A changed revision means you are not approving what was requested. Reject and let it be
> requested again, rather than approving a plan you have not read.

## 4. Decide

Approve, or reject. A reason is optional and is kept on the record.

On approval the run resumes from the beginning in the mode it was started in. On rejection
it ends without having run anything.

Selecting several runs enables **Bulk approve** and **Bulk reject**. Use it only for runs
you have actually reviewed; the record does not distinguish a bulk decision from a
considered one.

## Verify it worked

The run leaves the inbox and its status changes from **Paused** to **Running**, then to
**Completed**:

```text title="run record"
Status              Completed
Approved by         you@example.com
Approved at         2026-09-08 14:22
Requested revision  7
Approved revision   7
```

Matching revision numbers confirm the plan did not move between request and decision. The
same decision appears in the [audit log](/docs/governance/audit-log) as `approval.continue`
or `approval.abort`, with both revision numbers recorded.

## Next steps

- [Approval gates](/docs/running/approval-gates) for why the gate belongs to the environment
- [Audit log](/docs/governance/audit-log) for what the decision records