Nobody approves one thing while something else runs.

SecureCloudGate reads the current state from the provider and shows an exact before and after, the resources affected and whether the change can be rolled back.

Approval policy follows risk. A low-risk change may need one person; a critical one may need two of three plus a security approver. The requester can never approve their own request, and that rule is enforced on the server.

• Approver groups rather than single assignees
• N-of-M quorum with distinct identities
• Step-up authentication for sensitive approvals
• Approvals that expire

The request, its target, its parameters and the policy version are reduced to a single SHA-256 hash. Each approval is bound to that hash. If anything changes afterwards, the approvals no longer apply and the request goes back for review.

Immediately before execution the platform confirms that the approvers are still authorised, the approval has not expired, the policy still permits the action and the target still matches. Then it runs the change with short-lived credentials, verifies the result against the provider and records the outcome.