Decisions and automatic approval

Three decisions

Every request (and every plan) gets one decision:

• AUTO_APPROVED — fulfilled at once: a lease on a free pool target, or a dataset request that is scheduled.
• PENDING_HUMAN_APPROVAL — waits until a person with dataset.approve who is not the requester approves or rejects it (datanivra test-data approve <ID> --reason …). Build requests also appear in the console's dataset-request approval queue.
• DENIED — 403 TEST_DATA_REQUEST_DENIED with reason codes; nothing is created; the refusal is audited.

The rules, in order

1. The profile version must exist, be APPROVED, and match the checksum you pinned.
2. The request must stay inside the profile's bounds (offered scenarios, exact counts up to max_count, max_total_records, max_ttl_seconds). Outside → DENIED.
3. People keep exactly the powers they already have: a lease needs dataset.provision (otherwise a person approves); a build follows the tenant's request-approval scope (requests touching production sources wait for a second person).
4. Workload identities must be named by the profile's automation envelope (otherwise DENIED); quotas (max_live_requests, max_requests_per_hour) are hard limits. Inside the envelope and with automatic approval enabled → AUTO_APPROVED, recorded as approved by the person who approved the profile version. Inside the profile but outside the envelope → PENDING_HUMAN_APPROVAL, or DENIED when the envelope sets escalate_out_of_envelope: false. A workload never benefits from the scope-based automatic approval people get for synthetic-only builds.

Example envelope (synthetic)

The customer's trusted GitHub Actions identity for one repository may invoke the approved healthcare-integration profile with at most 500 patients and 2,000 appointments, masking policy version 3 pinned in the profile, only the approved QA target, and — through a lease profile over the certified version — a lease of at most two hours:

• 1,500 synthetic appointments, or a 1-hour lease of the certified version → AUTO_APPROVED (if enabled);
• a 3-hour lease → PENDING_HUMAN_APPROVAL (TTL_EXCEEDS_ENVELOPE);
• 2,500 appointments (above the profile's maximum), or another repository's identity → DENIED.

Off by default (Preview)

Automatic approval needs two switches: the DataNivra operator must offer it (DATANIVRA_TEST_DATA_AUTOMATIC_APPROVAL_AVAILABLE), and a tenant administrator must enable it for the tenant (datanivra test-data settings --automatic-approval on; refused with AUTOMATIC_APPROVAL_UNAVAILABLE while the operator has not offered it). Until both are on, every workload request waits for a person (AUTOMATIC_APPROVAL_DISABLED).

Pre-approval is not carte blanche: profile versions are approved by a second person who confirms the checksum; an envelope can never exceed its profile; sources, target references, masking policies, quotas, identity, revocation and certification are enforced by the server and by your agent; a profile version can be revoked at any time, and no pipeline or AI model can approve its own request or widen its envelope.

Reason codes

Audit

test_data_request.created, .denied, .approved, .rejected and .released record the profile id, version and checksum, the decision and the request checksum — never values. Automatically approved builds record the profile approver as the decider on the dataset request.

Related

• CI workload identity
• Profiles and manifests

← All documentation