Job Approval Threshold and Statement Retention

The Jobs and Statements group on the Hub Configuration page holds two Hub-wide settings: how many sites a job may reach before a second person must approve it, and how long the Hub keeps the statements it signs. Open System Administration -> Hub Configuration; only administrators see the page (see Hub Configuration). Click Save to keep a change.

Both fields are empty on a new Hub.

Approval Threshold (sites)

The number of sites a job may reach without a second person's approval. A job submitted for more sites than this waits for approval; a job for this many sites or fewer is ready to start once it is submitted. See Jobs for who may approve a job.

The value is a whole number, 0 or more, or empty:

• Empty means the threshold is not set. While it is empty, a job can reach only one site. Submitting one for more sites is refused with The job approval threshold is not set, so a job can reach only one site. A Hub administrator sets it in Hub Configuration.
• 0 means every job needs approval, even one for a single site.
• Any other number applies as written, including one as large as the fleet, which means no job needs approval.

The threshold is applied when a job is submitted. Changing it does not move a job that has already been submitted.

One Hub administrator can change the threshold alone. Approval therefore guards against misuse of an operator account and against mistakes, not against a compromised administrator account (see Security Guidance).

Statement Retention (days)

How long the Hub keeps the statements it signed, and the jobs that refer to them. Empty keeps them all. A value must be at least 1.

Once a day, the Hub's nightly cleanup deletes the statements older than this many days. It also deletes each job that ended longer ago than this, with its per-site results and its configuration file. A job that has not ended is not deleted.

The setting reaches further than the statement records themselves:

• Rollback. A site of a job can be rolled back from the Hub only while the job's record exists.
• Ending sessions. When a person loses access at the Hub, the Hub ends their Hub console sessions only at the sites where a console sign-in statement for them is still on file. A shorter retention narrows that reach.
• The audit file. Each statement is also written to hub-audit.log as a STATEMENT_SIGNED line, which this setting never deletes (see Hub Audit Log).

Empty, the Hub keeps every job's configuration file as well, each up to 190 MB. Each site keeps the statements it received for its own MCP audit retention period, whatever this setting says.

How the two settings shape a job is described in Job Approval and Job Retention.

Recording Changes

A change saved on the page is recorded in the Hub configuration's revision history, where the fields are labeled Job Approval Threshold and Statement Retention Days. A configuration import that changes either value also writes a JOB_SETTINGS_RESTORED event to the Hub audit log, naming who ran the import and both values before and after (see Hub Disaster Recovery).