Docs · Platform
How Approvals and policy works
From a proposed change to a receipt.
1A change is proposed
The request names the agent, the target system, the exact arguments, and the person Dex acts for.
2Policy classifies it before it runs
Observe actions run, change actions run within the policy you grant, sensitive actions need a named approver, and anything outside your authority is denied or sent to you as a decision.
3The named person approves
In the app queue or the Slack thread where the work started; the button works once, for that person.
4The change runs and leaves a receipt
Deixic runs exactly what was approved and records a signed receipt with the policy, the approval, the request and result hashes, and who acted for whom.
Policy testing and audit history
- Test a policy change first
- Replay past decisions against a proposed policy to see what it would have allowed or blocked.
- Unattended work needs standing authority
- Scheduled and proactive actions run under an approval or standing grant, with daily action and cost caps for each workspace.
- Approved work resumes where it paused
- A change that waited for an approval continues from the stage that needed the person, and finished changes do not repeat.
- Uncertain outcomes stay safe
- If a crash hides whether a change went through, Deixic records it as uncertain instead of sending it again.
- Tamper-evident audit log
- The audit log is hash-chained, and the database refuses edits and deletes.