Approvals & Governance
How sign-off, separation of duties, locks, legal holds, and AI data-handling work. The internal reference is governance-controls.md; this page is the user-facing view.
Approvals (award / bid decisions)
Approvals are opt-in. If your organisation has not configured an approval matrix for a decision type, decisions proceed without sign-off.
Setting up an approval matrix (Role: Admin)
Add a matrix rule for a scope (award or tender_bid): how many approvals a
decision needs, in which value band, and the minimum approver role. From then
on, that decision requires approval before it can be finalised.
Requesting and approving
- Open an approval request for the decision.
- Approvers approve or reject. The panel shows the requester and a per- approver trail: name, decision, time, and reason.
The rules that protect integrity
- Separation of duties — the person who requested a decision cannot approve their own. A different approver must act.
- Minimum role — an approval only counts if the approver's role meets the rule's
minimum (e.g. an
owner-required rule is not satisfied by anadmin). The approver's role is recorded on the decision. - Snapshot binding (awards) — an approval is tied to the exact decision it signed off on. If you later change the vendor, price, BoQ, or ESG eligibility, the old approval no longer counts and you must request a fresh approval.
If you are the only admin
You cannot approve your own request — that is the control working, not a bug. Your options:
- Withdraw your own pending request (you can cancel it, since cancelling is not self-approving), then award without a matrix; or
- Invite a second admin to approve; or
- Don't configure an approval matrix (awards proceed without sign-off).
Enforced approval inherently needs at least two people.
Locks & legal holds (ESG assessments)
- Lock / freeze an assessment to make it read-only — a signed-off audit snapshot.
- Legal hold blocks deletion/purge of the data even under retention, for litigation or audit. Place it and remove it deliberately.
AI processing policy (Role: Owner to change)
Your organisation chooses how document content may be processed by AI:
| Policy | Meaning |
|---|---|
| Approved external | External AI providers may be used (default). |
| Local only | Processing stays on local models — content never leaves the host. |
| Disabled | No AI processing; documents are handled manually. |
- View the current policy: Admin → AI policy (
GET /admin/ai-policy). - Change it (Owner):
PUT /admin/ai-policywith{"policy": "local_only"}. - The choice applies to the whole extraction and comparison pipeline, so nothing leaks past it.
Setting Local only keeps data on-premise but runs on local models (slower). Disabled stops AI entirely — expect to handle documents manually.
Audit trail
Every meaningful action — upload, extraction, comparison, approval, award, lock, hold, policy change — is written to an immutable audit log with a timestamp and the user who did it. This is what makes a decision defensible months later.