HITL gates and four-eyes

A gate.hitl pauses a run until an approval requirement is met. Four-eyes — the requirement that a second person approve what the first proposed — is configured through the same gate.

How a gate works#

1. The run reaches the gate; the gate opens and appears in the approvers’ inbox.
2. The ledger records gate.opened with the initiator, the step, and the justification.
3. Approvers act on their phone (WebAuthn / TOTP) or the web UI.
4. When quorum is met, the gate closes, the ledger records every approver signature, and the run continues.

Quorum, SLA, escalation#

gate:
  type: gate.hitl
  quorum: 2
  roles: [ops_lead, compliance]
  sla: 4h
  escalate: vp_ops

• Quorum — how many approvals are required (typically 2 for four-eyes).
• SLA — how long the gate may wait before escalation.
• Escalation — who the gate escalates to when the SLA expires.

Conflict-of-interest blocks#

• Self-approval block: the initiator of a run cannot approve their own request.
• Same-team block: approvers from the same team as the initiator can be excluded, if your policy requires it.

What the ledger records#

For every approval: the initiator, every approver, timestamps, the justification, and the policy that required the gate. The record is part of the hash chain — an examiner can verify it offline via an evidence bundle.

Setup#

See Set up four-eyes approval for the configuration walkthrough.