Job Approval¶
A job that reaches more sites than the Hub's approval threshold needs a second person's approval before it can start. The threshold is a Hub-wide setting, and until a Hub administrator sets it, a job can reach only one site. Approval, rejection and withdrawal all happen in the Hub console, in the job's details.
Submitting¶
Submitting a draft freezes it. The Hub checks every step and both limits (see Preparing a Job), then turns the job's tags into a fixed list of sites. A site given a tag later is not added. A rerun keeps its own list of sites, less any site that was unticked.
The Hub refuses to submit a job when:
- It reaches no site where the preparer holds the Jobs grant.
- It reaches more than one site while the approval threshold is not set.
- One of its sites is already in another unfinished job, one that is awaiting approval, ready to start, running or paused, or is being rolled back from a job. The refusal names each such site and the job it is in or is being rolled back from.
A submitted job that reaches more sites than the threshold is awaiting approval. Otherwise it is ready to start at once. The job editor says which before the job is submitted, and its button reads Submit for Approval when the job will need approval; see What Submit Does.
The Hub records a version warning for each site that runs an older QIE version than the one that exported the file; see Job Details. It also records how the preparer's session signed in: a password, an LDAP password or an OIDC identity provider, and whether an emailed one-time code was also passed. A job submitted through the Hub's MCP server comes with an MCP token instead of a session, so the method is recorded as unknown. Each statement the job sends carries this to the site.
The Approval Threshold¶
The threshold is Approval Threshold (sites) in the Jobs and Statements section of System Administration -> Hub Configuration, which only Hub administrators see; see Job Approval Threshold and Statement Retention.
| Value | Effect |
|---|---|
| Empty (the default) | Not set: a job can reach only one site, and needs no approval |
| 0 | Every job needs approval |
| A number N | A job that reaches more than N sites needs approval |
The threshold is read when a job is submitted. Changing it does not move a job that has already been submitted.
The threshold applies to each job on its own
The same sites can be split across several jobs that each stay within the threshold, and none of them then needs approval. A site can be in only one unfinished job at a time, and in none while it is being rolled back.
A configuration import that changes the threshold writes a Hub audit entry naming who ran the import and the value before and after. See Hub disaster recovery.
Who May Approve¶
Anyone other than the preparer may approve a job, when their role holds the Jobs grant at every site in its list at the moment they approve. Hub administrators are no exception: their role needs the grant at every site too (see Site Access Grants).
A job that waits for approval shows "Awaiting approval" in the State column of the Jobs page. Choose Awaiting approval in the State filter to list only those jobs. To approve one, open it and click Approve. The Hub records who approved it, when, and how their session signed in, and each statement the job sends names the approver.
Before approving, the approver sees the whole job:
- On the Job tab: the configuration file's name, who exported it, where and when, the version that exported it and its SHA-256, the steps, the tags and the limits. View Contents shows everything the file holds, as the job imports it (see Job Details).
- On the Sites tab: each site, with what the Hub already knows may stop it, such as a newer file than the site runs, a site that is offline, or a site that would refuse the preparer's statements. See Job Details.
The Hub does not preview what the import would change at each site.
An approval or rejection applies only to the job as the approver saw it. When the preparer withdraws, changes and submits it again in the meantime, or it changes in any other way, Approve and Reject are refused with "The job has changed since you opened it. Look at it again first." Reopen the job to see it as it now is.
Approving happens only in the console. The Hub's AI tools can submit a job but cannot approve one.
Rejecting¶
Anyone who may approve a job may reject it instead. Click Reject and enter the reason, which the preparer sees in the job's details. Rejection is final: the job ends as rejected, each of its sites shows rejected, not run, and it never runs. To try again, copy it into a new draft; see Copying and Rerunning a Job.
Stopping a Job That Waits for Approval¶
A Hub administrator, or the preparer, can stop a job that is awaiting approval, for example when nobody who may approve it will, or its preparer has left. Click Stop in its details and confirm. The job ends as stopped, every site in its list ends as "stopped, not run", and the sites are free for other jobs.
Withdrawing¶
The preparer can take a job back to a draft before it starts, while it is awaiting approval or ready to start. Click Withdraw in its details. The job returns to the preparer's drafts with its site list and any approval cleared. Submitting it again turns its tags into sites afresh and, beyond the threshold, needs approval again.
After Approval¶
The preparer and the approver can each start, pause, resume, continue and stop the job; a Hub administrator can also stop it. Every step runs at the site as the preparer's Hub user, and a site refuses a step when it has disabled the Hub user of either person. When either person is disabled or deleted at the Hub, a running job stops. See Running a Job.