Maintenance approvals and change windows
Bind disruptive execution to a reviewed plan revision and explicit approval policy.
Maintenance approvals authorize a specific plan revision before disruptive work begins. Approval records identify the reviewed targets, actions, window, and maximum concurrency.
Require approval
An organization policy can require approval for production drains, forced stops, storage evacuation, or changes selected by environment labels. The policy names eligible approver teams and whether the requester can approve their own plan. Self-approval is disabled by default.
A plan requiring approval stays awaiting_approval. It can run validation and
produce an impact preview, but it cannot start a protected action. Having write
permission to a node does not automatically grant permission to approve a plan
that affects protected workloads.
Review the revision
Open Plan → Approval and inspect the resolved target IDs, affected projects, placement blockers, application dependencies, and proposed execution window. The approval records the plan revision and preflight digest.
An edit to targets, actions, concurrency, or the permitted window invalidates existing approvals. A fresh observation of ordinary metrics does not by itself change the plan revision. Execution still repeats health and capacity checks; approval does not reserve a future state.
Windows and exceptions
A window permits new disruptive steps to start during its configured interval. A step already committing can finish after the interval so it reaches a consistent state. The end of a window is not a forced cancellation boundary.
An emergency exception requires its own permission, reason, scope, and expiry. It authorizes the specified action outside the ordinary window; it does not disable fencing, storage ownership, or basic resource validation.
Rejection, expiry, and pause
Rejecting a plan leaves its configuration and preflight available for revision. An approval that expires before execution must be renewed. A paused plan can resume under the same approval only while its approved revision and window remain valid.
Revoking approval stops admission of new protected steps. Children already running follow their operation lifecycle. An operator must separately request cancellation from children that permit it.
Completion evidence
The plan result links each child operation to the approval in force when the step was admitted. Successful, failed, skipped, and canceled targets remain separate outcomes. Export the plan, approval, and operation records for a change review rather than treating the approval itself as evidence of completion.
Use Maintenance API for revision-bound approval requests, custom roles for approver permissions, and audit streaming for external change records.