Skip to content
Tutorials
PyBritive CLI
Approval Workflows

Approval Workflows

Overview

Some Britive profiles require a justification or approval from a manager or administrator before credentials are issued. PyBritive supports two approaches: a blocking checkout that waits for approval automatically, and a non-blocking request submission that lets you continue working while your request is reviewed.

What you’ll learn:

  • How to check out a profile that requires a justification
  • How to check out a profile that requires approval
  • How to submit a non-blocking access request
  • How to list, approve, and reject pending requests as an approver
  • How to withdraw a request you no longer need

Before You Begin

Note: Profile names in this tutorial are from the Britive demo tenant. Replace them with your own profile names from pybritive ls profiles.

Submit and Manage Approval Requests

Check out a profile that requires a justification

Some profiles require a justification before credentials are issued but do not require approval from another user. Pass the justification directly with the --justification flag:

pybritive checkout "AWS SE Organization/696226360299 (se-demo)/S3 Bucket Admin-Justification" \
  --justification "Investigating S3 bucket permissions"

Credentials are returned immediately once the justification is provided — no waiting for approval.

To load the credentials directly into your shell session instead of printing them:

eval $(pybritive checkout "AWS SE Organization/696226360299 (se-demo)/S3 Bucket Admin-Justification" \
  --justification "Investigating S3 bucket permissions" \
  --mode env)

See AWS Credentials for all available credential modes.

Check out a profile that requires approval

When you run checkout on a profile that requires approval, PyBritive submits the request and polls automatically until it is approved.

pybritive checkout "AWS SE Organization/696226360299 (se-demo)/S3 Bucket Admin-Approval" \
  --justification "Investigating production incident #1234"

PyBritive displays ... while polling and returns credentials automatically once approved.

To adjust the maximum wait time (in seconds):

pybritive checkout "AWS SE Organization/696226360299 (se-demo)/S3 Bucket Admin-Approval" \
  --justification "Investigating production incident #1234" \
  --maxpolltime 300

Press Ctrl+C at any time to cancel the wait without withdrawing the request.

Submit a non-blocking request

If you do not want to wait at the terminal, use pybritive request submit to submit the request and return immediately:

pybritive request submit "AWS SE Organization/696226360299 (se-demo)/S3 Bucket Admin-Approval" \
  --justification "Investigating production incident #1234"

When your request has been approved, run checkout to retrieve your credentials:

pybritive checkout "AWS SE Organization/696226360299 (se-demo)/S3 Bucket Admin-Approval"

List pending approvals

If you are an approver, list requests that are waiting for your review:

pybritive ls approvals

To view in a more readable format:

pybritive ls approvals --format table

Note the REQUEST_ID from the output — you will need it to approve or reject.

Approve a request 

pybritive request approve REQUEST_ID

Replace REQUEST_ID with the ID from pybritive ls approvals.

Reject a request 

pybritive request reject REQUEST_ID

Withdraw a request

If you submitted a request but no longer need access, withdraw it:

pybritive request withdraw "AWS SE Organization/696226360299 (se-demo)/S3 Bucket Admin-Approval"

Troubleshoot

SymptomCauseFix
Checkout times out waiting for approvalApprover did not respond within --maxpolltimeIncrease --maxpolltime or contact your approver directly
ls approvals returns nothingNo pending approvals assigned to your identityConfirm you are the designated approver for this profile
request submit succeeds but checkout still blocksProfile still requires approvalWait for approval then run pybritive checkout again
Cannot withdraw requestRequest already approved or rejectedCheck in the profile if already checked out

Next Steps

  • SSH Access — connect to private AWS and GCP instances using PyBritive
  • Shell Completion — set up tab completion for PyBritive commands in your shell
Last updated on
OTP and Step-Up AuthenticationSSH Access