ProductApprovals
Nothing shipsuntil someone says so.
Approval is a state machine on the server. The browser, the API, and every agent go through the same transitions. Machines can draft. Only signed-in members move posts to review, and only members with approval rights can approve.
Transitions
One table.Every caller.
This table is generated from the transition map the server enforces. Every decision needs a signed-in member. A decision applied outside its starting states is refused, and there is no force transition or administrative override.
| Decision | From | To | Roles allowed |
|---|---|---|---|
| Submit for review | DRAFT, NEEDS_CHANGES | READY_FOR_REVIEW | owner, admin, creator |
| Approve | READY_FOR_REVIEW | APPROVED | owner, admin, approver |
| Reject | READY_FOR_REVIEW | REJECTED | owner, admin, approver |
| Request changes | READY_FOR_REVIEW | NEEDS_CHANGES | owner, admin, approver |
Approval is the human gate the whole platform rests on.
Roles
Separate the decisionfrom the delivery.
Six fixed roles. Approving and publishing are separate permissions, so an approver can sign off without publishing rights and a publisher can schedule without approval rights. A solo founder holds every role and can approve their own work.
| Permission | owner | admin | creator | approver | publisher | viewer |
|---|---|---|---|---|---|---|
| Read campaigns and assets | ||||||
| Create releases and submit posts | ||||||
| Edit drafts and designs | ||||||
| Approve, reject, request changes | ||||||
| Schedule and cancel posts | ||||||
| Manage brand and product | ||||||
| Invite members | ||||||
| Read the audit log | ||||||
| Configure SSO and SCIM | ||||||
| Delete the workspace |
Batch
Approve all seven.Or exactly three.
Batch approval is the primary action, not an optimization. Approving seven posts is one click, one transaction, and one audit entry.
postIds: omittedEvery eligible post
Leave the list out and the decision applies to every post in the campaign that can take it. That is the Approve all button.postIds: [a, b, c]Exactly these posts
Name the posts and the call is all or nothing. If one is not eligible, nothing changes and the call returns 409.409 · nothing eligibleNo silent success
A double-clicked Approve reports a clear conflict instead of pretending a second approval happened.one winner, one 409Concurrent reviewers
Two approvers acting at once produce one success and one conflict. No row is locked while someone thinks.
Scheduling
Approved is not enough.Six checks to schedule.
Approval and scheduling are separate gates. Scheduling checks the post again, and the delivery worker checks the creative a third time just before it calls the network.
- 1The post belongs to your workspace
- 2The post is approved
- 3A creative is attached
- 4The copy is within the length limit
- 5The destination channel is active and yours
- 6The creative itself is approved
A creative archived after approval never publishes. The worker cancels the post and writes the cancellation to the audit log.
Audit
Who decided what,on which version.
Every transition writes to the audit log inside the same transaction, so a state change and its record commit or roll back together. Entries carry the actor, the request ID, and the outcome.
| Event | What it records |
|---|---|
| product.campaign_created | A campaign and its post count |
| product.campaign_post_status_changed | A decision and how many posts it covered |
| product.campaign_post_scheduled | The campaign and the scheduled post |
| post.scheduled | The destination and the creative |
| post.cancelled | Who cancelled it |
| post.published | The provider post ID |
| post.publish_recovery_required | The failure code, for a person to resolve |
What is next
Policies later.People first.
Policy-based automatic approval and the Copilot and Autopilot modes are designed and written down, not shipped. The default stays the same: everything needs a person.
Approval policies
Rules a workspace writes for what may publish automatically, such as educational posts, while announcements, metrics, pricing, and competitor mentions always need review.
Autonomy modes
Manual, Copilot, and Autopilot. A mode gates triggers and automatic approval. It never widens what a role may do.
Questions
Anything else? Talk to us.
Can I approve my own posts?
Can an API key or the AI approve anything?
Does typing “approve them” in chat approve anything?
What happens to a post that needs changes?
Do release emails need approval too?
Related