update_approval_policy
Writes a project's approval policy for one kind, after the person confirms; who decides, how many must agree and how long they have.
Write a project's approval policy: project_id and kind (requirement_review, the kind open today) are required, with any of rule (any, all or quorum), quorum (1 to 50), approver_roles (project roles whose holders approve; the guest role never), approver_user_ids (members of the team asked by name), approver_stakeholder_ids (the client's seats, deciding once linked to an account), sla_hours, reminder_hours and auto_approve_after_hours (1 to 720, null for no clock), requires_comment_on_reject and enabled. A key left out takes the workspace default, not the project's current value, so send the whole policy as it should stand. Requests already open keep the approvers they were sent to. The policy goes through the same action the Settings page runs and approval.policy_updated goes out with what changed.
The tool is destructive in the MCP sense: a policy decides whose word carries a record, so a Heimdall turn pauses for the person's confirmation and an MCP client asks before sending. A staff token with approval:manage-policies on the project is needed.
Requires ability
The token behind the MCP session must hold it, or the call is refused with TOKEN_MISSING_ABILITY.
Annotations
A client that honours annotations asks a person before running it.
Arguments
project_id*stringUUID of the project.
kind*stringThe kind of approval the policy decides.
requirement_reviewclient_sign_offbaseline_approvalchange_requestdocument_approvalsprint_commitmentrulestringoptionalHow many approvals carry a request.
anyallquorumquorumintegeroptionalHow many approvals carry a request under the quorum rule, 1 to 50.
approver_rolesstring[]optionalThe project roles whose holders approve.
approver_user_idsstring[]optionalUUIDs of the team members asked by name.
approver_stakeholder_idsstring[]optionalUUIDs of the client's stakeholder seats asked.
sla_hoursintegeroptionalHours to decide before the request is overdue, 1 to 720; null for no clock.
reminder_hoursintegeroptionalHours after which the undecided approvers are nudged once; null for none.
auto_approve_after_hoursintegeroptionalHours after which an unanswered request carries by itself; null to never let it.
requires_comment_on_rejectbooleanoptionalWhether a rejection or a request for changes must say why.
enabledbooleanoptionalWhether the gate is on; off, a submission is approved at once.
What it returns
{ "data": { "kind": "requirement_review", "rule": "all", "quorum": 1, "approver_roles": ["project_manager", "business_analyst"], "approver_user_ids": [], "approver_stakeholder_ids": ["5e6f7a8b-9c0d-4e1f-8a2b-3c4d5e6f7a8b"], "sla_hours": 48, "reminder_hours": 24, "auto_approve_after_hours": null, "requires_comment_on_reject": true, "enabled": true, "stored": true }}How it fails
VALIDATION_FAILEDa kind that is not open, a rule outside the three, a quorum or a clock outside its range, more roles, people or seats than allowed, the guest role, a person who is not on the team, a seat that is not the project's, or a gate switched on with nobody named.
RESOURCE_NOT_FOUNDunknown project_id, or a project outside the token's scope or the person's visibility.
FORBIDDENthe token is a client guest's, or the holder's role on the project does not carry approval:manage-policies.
TOKEN_MISSING_ABILITYtoken lacks approval:manage-policies.
How is this guide?
Last updated on