> ## Documentation Index
> Fetch the complete documentation index at: https://docs.useautumn.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Approval Rules

> Limit what people on your team can do

Approval rules limit what members of your team can do. For example:

* Sales can give discounts up to 20%, but not more.
* Only admins can void invoices.
* Nobody can delete plans in live mode.

Set rules in **Settings → Approvals**. Only owners and admins can create or edit rules.

## Parts of a rule

| Part | Meaning |
| - | - |
| **Who** | Everyone, one or more roles, or specific members. |
| **Actions** | What the rule covers. For example: attach a plan, cancel, void an invoice. |
| **Allow** | Always, never, or only when conditions match. |
| **Note** | Optional. Blocked members see this message. For example: "Ask finance for bigger discounts." |

You can turn a rule off without deleting it. Autumn saves every change as a new version.

## How Autumn checks a request

1. **The role must already allow the action.** Rules can only take permissions away. They never give new permissions.
2. **The most specific rule decides.** A rule for a member beats a rule for their role. A rule for a role beats a rule for Everyone.
3. **All rules at that level must pass.** If two rules name the same role, the request must pass both.

If no rule covers the member and the action, the action is allowed.

> [!NOTE]
>
> **Example.** Rule A: Everyone can never cancel. Rule B: Admins can always cancel.
>
> An admin can cancel, because rule B is more specific. A developer cannot, because only rule A applies to them.

## Actions

| Area | Actions |
| - | - |
| Billing | Attach, update subscription, set plans, create schedule, cancel, uncancel |
| Invoices | Create, finalize, pay, void, update, reissue, issue credit note |
| Balances | Create, set |
| Rewards | Create, redeem |
| Customers | Update, delete |
| Plans | Create, update, delete |
| Features | Create, update, delete |
| API keys | Create |
| Migrations | Create, run |

## Conditions

A rule can allow an action only when conditions match. The conditions depend on the action:

* **Customer state** (any action on a customer): customer ID, plans the customer has now, features the customer has now, customer has paid before (any paid invoice above zero)
* **Billing:** incoming or outgoing plan, amount due now, next cycle amount, discount, trial, quantity, custom pricing, checkout link, entity type, proration, timing, billing cycle, start date, invoice mode
* **Cancel:** timing, plan, refund
* **Invoices:** invoice total, refund or credit amount
* **Balances:** feature, amount, unlimited, expiry date, reset interval, remaining, usage
* **Rewards:** reward
* **Plans:** plan, plan items (feature, feature type, pooled)
* **Features:** feature
* **All actions:** environment (live or sandbox)

A plan condition can check the plan ID, version, price, and if the plan is paid, recurring, an add-on, or custom.

You can combine conditions with AND and OR. The editor shows the rule as a sentence, so you can check what it means.

## When an action is blocked

* In the dashboard, the button is disabled. It shows "Blocked by an approval rule".
* The request fails with a `403` error and the code `permission_denied`. The error shows the rule, the conditions that failed, the rule's note, and the roles that can do the action.
* Billing previews show if a change will be blocked, before you confirm it.

To make the change, ask a member with one of those roles.

## Good to know

* Rules can apply to owners and admins too.
* Rules apply to members in the dashboard, and to apps where a member signs in with their Autumn account.
* Secret API keys are never limited by rules.
* In sandbox, a rule only applies if it has an environment condition. All other rules only apply in live.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.