Skip to main content

Reviews

Workflows run unattended by design. A review is the deliberate exception: a point where the pipeline stops and waits for a person to make a call.

Reviews are how you keep a human decision in an otherwise automated process — signing off on an SBOM before it is published to customers, approving a report before it is filed, or confirming that flagged findings are acceptable.

How a review works​

You add a Review node at the point in the workflow where the decision belongs, and give it a reviewer's email address.

When an execution reaches that node:

  1. The run pauses. Its status becomes pending approval, and the node's status becomes awaiting approval.
  2. The reviewer receives an email with the data under review attached, and a secure one-time link.
  3. Nothing downstream of the review node runs while the workflow waits.

The reviewer opens the link, examines what is there, and decides:

  • Approve — the node is marked approved and the run continues down the success path as if the node had completed normally.
  • Reject — the node is marked rejected and the failure path is taken, exactly as if the node had failed. If there is no failure path, the execution ends as rejected.

Designing around rejection​

A rejection is not an error — it is a decision, and it is worth designing for. Hanging a failure path off the review node lets you do something deliberate with it: notify the submitter, write the outcome to a database, or produce a report explaining what was turned down.

Without a failure path, a rejected run simply stops, and the only record is the execution's status.