Every approval has a name, a reason and a code.

• Choose what an approval covers: this port only, any port on this VLAN at this site, or anywhere. Optionally set an end date. A reason is required, and it is printed in the evidence pack.
• Enter the six-digit code from an authenticator app. Signed actions need an authenticator code entered in the last five minutes; each code works once.
• Before anything is signed, the appliance checks that the device still matches what the page showed. If it changed, nothing is signed, and the page says so.
• Your role is checked again inside the write itself, not only on the page.
• A device that moves to another port or VLAN goes back to Needs decision, with a location-mismatch alert.
• For a device marked not approved, the alert prints the command to shut its port, for a person to run. The appliance never sends it.

Each decision is its own entry in the hash-chained log, proved in the Merkle tree. exceptions.csv in every pack lists not-approved and excluded devices with who decided, when and why, and a content hash ties each decision to the exact state the person saw.

Entries this feature writes to the tamper-evident audit log. Each one is in the evidence packs that cover its date.

• decisionWho decided and how they signed in, the old and new status, the scope, location, reason, end date and a content hash.
• alert_resolvedThe alert the decision closed, with who and why.
• status_changedThe device’s new status, linked to the decision.

What it does not do yet, stated plainly. The technical page lists every known gap.

• Sign-in is a password plus an authenticator app. Single sign-on with Entra ID or Okta is planned, not built.
• Shut-port commands and hardening advice are written in Cisco syntax today.