Skip to content
AIGP

RFC-012: Artifact Lifecycle Protocol (ALP) — 7. Approval Rules

AIGP Specification › RFC-012: Artifact Lifecycle Protocol (ALP) › 7. Approval Rules

← 6. Provenance Chain · Section index · 8. Compensation →

7. Approval Rules

Approval authority is determined by artifact type and blast radius. The protocol defines three approval tiers.

7.1 Blast Radius Classification

Scope Description Examples
RESOURCE Single resource affected One IAM policy, one config file
SERVICE Multiple resources within one service All policies in an account, all Lambda functions
ACCOUNT Cross-service impact within one account IAM + S3 + Lambda changes in account 705909755305
ORGANIZATION Cross-account impact SCPs, organization-wide policies, multi-account changes

7.2 Approval Matrix

Artifact Type Blast Radius Required Approver Auto-Approve Eligible
REPORT Any None (auto-approved) YES
MANIFEST Any None (auto-approved) YES
JSON_CONFIG RESOURCE Agent (self-approve) YES
YAML_CONFIG RESOURCE Agent (self-approve) YES
PYTHON_SCRIPT RESOURCE Human OR senior agent NO
SHELL_SCRIPT RESOURCE Human OR senior agent NO
PYTHON_SCRIPT SERVICE Human NO
SHELL_SCRIPT SERVICE Human NO
IAC_TEMPLATE RESOURCE Human NO
IAC_TEMPLATE SERVICE Human NO
POLICY_DOCUMENT Any Human (security reviewer) NO
Any executable ACCOUNT Human (account owner) NO
Any executable ORGANIZATION Human (org admin) + Human (security reviewer) NO

7.3 Approval Expiry

Approvals MUST carry an expiry timestamp. Default expiry periods:

Blast Radius Default Expiry
RESOURCE 24 hours
SERVICE 12 hours
ACCOUNT 4 hours
ORGANIZATION 1 hour

An expired approval MUST NOT be used for execution. The artifact MUST be re-promoted through REVIEW APPROVED.

7.4 Approval Validation

from datetime import datetime, timezone


def validate_approval(artifact: dict, execution_request: dict) -> tuple[bool, str]:
    """Validate that an artifact's approval is current and hash-matched."""
    if artifact["state"] != "APPROVED":
        return False, f"Artifact is in {artifact['state']}, not APPROVED"


    approval = artifact.get("approval", {})


    # Check expiry
    expiry = datetime.fromisoformat(approval["expiry"])
    if datetime.now(timezone.utc) > expiry:
        return False, f"Approval expired at {approval['expiry']}"


    # Check hash integrity
    if execution_request["approved_hash"] != artifact["content_hash"]:
        return False, "Content hash mismatch  artifact modified after approval"


    return True, "Approval valid"

← 6. Provenance Chain · Section index · 8. Compensation →