# Approval on connection

> How a privileged session is approved: the two approval moments, the quorum, what the approver sees and how sudo commands are approved as well.

URL: https://docs.ironchip.com/en/pam/conceptos/aprobacion/

This page explains how privileged access is approved and the difference between approving on request and approving on connection. You need it if you manage policies or approve requests.

## Approval is one more factor

In Ironchip, approval is not a separate setting: it is an [approval policy](https://docs.ironchip.com/en/pam/administracion/aprobadores/) that you add to an access just like a device or a safe zone. That is why it combines with them. For example, an access can require `Device AND Office safe zone` **or** `Device AND Approval`, so that approval makes up for being away from the office.

An access with no approval in any combination is **permanent**: the person connects whenever they want. One with approval is **on request**: the person asks for a window.

## The two approval moments

|                        | On request (**When access is requested**)                        | On connection (**When the person connects**) |
| ---------------------- | ---------------------------------------------------------------- | -------------------------------------------- |
| When it is asked       | When the access is requested                                     | When the person opens the connection         |
| What it opens          | A time window                                                    | Only that connection                         |
| Several connections    | The person connects as many times as they like within the window | Each connection waits for its own decision   |
| What the approver sees | The request and its reason                                       | Someone at the door, now, from an address    |
| When to use it         | Planned work                                                     | Machines where every connection matters      |

**On request.** One approval opens a window. Inside it, every connection still goes through the broker and the address and factor check. The window closes automatically when it expires.

**On connection.** The request waits and nobody is asked until the person connects. The broker holds the connection while the approvers decide, so the question they answer is "should this be happening now?". If nobody decides within 5 minutes, the connection is rejected. A new connection asks again.

## Quorum and window

- **Approvers required** says how many different people have to approve. With `0`, the window opens as soon as it is requested.
- The window starts with the last required approval and lasts as long as was requested, up to the policy's maximum.
- If an access has several approval policies, the strictest one applies.

## Rules

- Nobody approves their own request or approves the same one twice.
- The approved window closes automatically.
- Approval does not skip any check: the address and factors are evaluated on every connection.
- Approval also counts as a factor for your single sign-on (SSO) applications.

## Approving commands and programs

If you install the [agent on the machines](https://docs.ironchip.com/en/pam/administracion/agente/), [control policies](https://docs.ironchip.com/en/pam/administracion/politicas/#control-policies) take the decision beyond the connection:

- On **Linux**, every `sudo` asks Ironchip: it is allowed, rejected with an explanation of why, or held until someone approves it in **PAM > Approvals**. The record shows who authorized it and under which rule.
- On **Windows**, only the allowed programs can be opened while the session lasts, even if they are renamed.

## More information

- [Approvals](https://docs.ironchip.com/en/pam/administracion/aprobadores/): create approval policies and decide requests.
- [Accesses](https://docs.ironchip.com/en/pam/administracion/accesos/): where approval is added.