Environment approval policy

Give each environment its own approval policy so the people who own the cloud decide when changes land. For BYOC deployments where you run inside an end-customer's account, set that customer's environment to Require approval and every installation task waits for a manual approval of the previewed change before it applies — while your own environments stay on Auto-approve and ship without prompts, or on Use service default to defer to each service. The policy lives on the environment's requireApproval field, so it flows through YAML and the CLI and stays in Git sync alongside the rest of your environment config.