Skip to main content
Approval rules limit what members of your team can do. For example:
  • Sales can give discounts up to 20%, but not more.
  • Only admins can void invoices.
  • Nobody can delete plans in live mode.
Set rules in Settings → Approvals. Only owners and admins can create or edit rules.

​
Parts of a rule

You can turn a rule off without deleting it. Autumn saves every change as a new version.

​
How Autumn checks a request

  1. The role must already allow the action. Rules can only take permissions away. They never give new permissions.
  2. The most specific rule decides. A rule for a member beats a rule for their role. A rule for a role beats a rule for Everyone.
  3. All rules at that level must pass. If two rules name the same role, the request must pass both.
If no rule covers the member and the action, the action is allowed.
Example. Rule A: Everyone can never cancel. Rule B: Admins can always cancel.An admin can cancel, because rule B is more specific. A developer cannot, because only rule A applies to them.

​
Actions

​
Conditions

A rule can allow an action only when conditions match. The conditions depend on the action:
  • Customer state (any action on a customer): customer ID, plans the customer has now, features the customer has now, customer has paid before (any paid invoice above zero)
  • Billing: incoming or outgoing plan, amount due now, next cycle amount, discount, trial, quantity, custom pricing, checkout link, entity type, proration, timing, billing cycle, start date, invoice mode
  • Cancel: timing, plan, refund
  • Invoices: invoice total, refund or credit amount
  • Balances: feature, amount, unlimited, expiry date, reset interval, remaining, usage
  • Rewards: reward
  • Plans: plan, plan items (feature, feature type, pooled)
  • Features: feature
  • All actions: environment (live or sandbox)
A plan condition can check the plan ID, version, price, and if the plan is paid, recurring, an add-on, or custom. You can combine conditions with AND and OR. The editor shows the rule as a sentence, so you can check what it means.

​
When an action is blocked

  • In the dashboard, the button is disabled. It shows “Blocked by an approval rule”.
  • The request fails with a 403 error and the code permission_denied. The error shows the rule, the conditions that failed, the rule’s note, and the roles that can do the action.
  • Billing previews show if a change will be blocked, before you confirm it.
To make the change, ask a member with one of those roles.

​
Good to know

  • Rules can apply to owners and admins too.
  • Rules apply to members in the dashboard, and to apps where a member signs in with their Autumn account.
  • Secret API keys are never limited by rules.
  • In sandbox, a rule only applies if it has an environment condition. All other rules only apply in live.