Some Gamebook actions have significant operational impact. ContraForce supports approval workflows to add a human checkpoint before these actions execute.
How It Works
- An analyst selects a high-impact action in a Gamebook
- The action enters Pending Approval status instead of executing immediately
- A designated approver receives a notification
- The approver reviews and either approves or rejects
- Approved actions execute automatically; rejected actions are cancelled
Common Actions Requiring Approval
- Isolate Device — Can take a production system offline
- Disable Account — Locks a user out of all services
- Reset Password — Forces credential change
- Offboard Device — Removes endpoint management
Configure approval requirements based on your risk tolerance. Some teams require approval for all isolation actions; others only for executive accounts or critical servers.
Checking Pending Approvals
Pending approvals are visible in the Command Dashboard Gamebook Activity widget, the incident Workbench, and via email notifications (if configured). 
