Approvals

Some changes only count once a person decides them: a policy is in force once approved, evidence counts once accepted, an access review proves something once completed. Each decision is recorded with who made it, when, and why.

Who can approve

A compliance reviewer makes these decisions. A reviewer is:

• an administrator (Super Admin, Tenant Admin or Org Admin);
• a holder of the GRC role, or of a compliance admin, manager or reviewer role; or
• anyone granted the compliance:review, compliance:approve, compliance:admin or compliance:manage permission.

Three rules sit above the role check:

• An auditor does not decide your programme. The Auditor role alone is not a reviewer: an external auditor tests management's decisions and does not make them. In an audit engagement, though, the auditor accepts or rejects what you submit against their requests (see audit requests).
• The assistant never decides. A change made through Safeguard's AI assistant or an MCP client can draft and submit, but never accept, approve, launch or acknowledge, whoever is signed in behind it.
• Unknown roles are refused. If Safeguard cannot tell who is deciding, it refuses the decision and says why, rather than assume.

Policies

On Compliance › Policies, a policy goes to review with Submit for review, and a reviewer approves it. An approval covers one version of the content.

• Editing an approved policy sends the new version to review, while the approved version stays in force. Staff keep following the text they were asked to follow until the new one is approved.
• On approval, the effective date defaults to the approval day and the next review to one year later. Marking the annual review done moves the review date on by a year without a new version.
• A reviewer launches an acknowledgement campaign (Launch) so staff acknowledge a specific approved version.

Evidence

On Compliance › Evidence, evidence starts as submitted, and a reviewer chooses Accept or Reject. The decision is stamped with who made it, when and why.

• A result recorded by an automated test from its own run starts accepted on that basis.
• Changing accepted evidence (its file, link, note, dates or control) makes a new version, which goes back to submitted: an acceptance covers the version the reviewer saw.
• Accepted evidence with an end date becomes expiring inside its reminder window and expired from that date.

Access reviews

On Compliance › Access Reviews, Launch campaign pulls every account from the connected systems in scope and assigns each one to a reviewer: per system, each person's manager, or one group of reviewers. Each reviewer gets a task.

• For each account the reviewer decides Keep, Revoke or Modify. Revoke and Modify need a reason. The item's reviewer, the campaign owner or a tenant administrator can decide.
• A decision never removes access by itself. Revoking is a separate, explicit confirmation for each item, carried out through the connected system or as a ticket.
• Complete campaign needs every item decided. It freezes the decisions and produces the evidence: a CSV, a signed summary and evidence records for the access controls.

Test exclusions

On a test's detail page under Compliance › Tests, Exclude asks to exclude one resource from that test, such as a break-glass account. Give a Reason, choose an Approver and set Expires on.

Nothing is excluded until the approver approves it. From then until the expiry date, the resource counts as not applicable, with your reason shown as the evidence. An exclusion is Pending approval, Approved, Rejected, Revoked or Expired; the Exclusions tab lists them.

Risk acceptance

On Compliance › Risks, accepting a residual risk depends on its level:

• Low or medium: the risk owner can accept it, recorded with their name and reason.
• High or critical: acceptance needs an approver with an admin role, and a date to review it within a year.

If the residual risk later rises above the level it was accepted at, the acceptance shows Needs re-approval: re-approve it or revoke it.

Crosswalk mappings

On Compliance › Crosswalk, a reviewer decides whether a mapping between two frameworks' controls holds for your programme: Approve, Reject (with why it does not hold) or Withdraw decision.

• Approving an equivalent mapping makes accepted evidence for the source control count toward the target control in your programme. Approving a partial mapping confirms the suggestion but makes nothing count.
• Decisions are never edited or deleted: each is a new record, and the latest one counts, so the full history stays readable. Each is tied to the mapping's text, so an approval no longer applies if a later crosswalk version changes the mapping.

Trust Center

• Access requests to your restricted documents are approved or denied by a reviewer, unless an auto-approval rule decides them (Trust Center access requests).
• Audit outcome: only a compliance reviewer or administrator can publish or take down the auditor's opinion on your Trust Center (Trust Center setup).

Audit requests

In an audit engagement, the auditor lists what they need. Your team answers each request and chooses Submit to auditor; the auditor then chooses Accept or Reject, giving a reason for a rejection. Only auditors accept requests, draw samples, open findings and issue opinions.

Assistants and MCP clients

Safeguard's AI assistant and MCP clients such as Claude or ChatGPT can read your programme and prepare changes, within the access your workspace and role allow. Two safeguards apply:

• Writes wait for you. An MCP client runs a write only after you confirm it in that client. In Griffin AI Search, every write shows a Confirm / Cancel card and runs only after you choose Confirm.
• Decisions stay with people. Even a confirmed write cannot approve, accept, launch or acknowledge anything: those decisions are made by a person in the app.

Related

• Requests and approvals
• Trust Center access requests