How every change gets approved
Changes to your registers are filed as proposals and saved only when an owner or admin approves them.
5 min read
ShelfGRC uses a maker-checker model: a change to your registers waits as a proposal until an owner or admin approves it.
When you submit a change, ShelfGRC files it as a proposal and takes you to its page. Nothing in the register changes until an owner or admin approves it. Members can create proposals and follow them in the Proposals queue; only owners and admins can approve or reject. A proposal cannot be withdrawn or edited once it is submitted. See Maker-checker and Proposal.
Proposal statuses
- Pending
Waiting for a decision.
- Approved
The change has been written to the register.
- Rejected
The change was discarded. Nothing in the register changed.
Almost every change to register content is proposed first, and a few owner and admin actions save directly.
Changes that become proposals
- New records
Click New, fill in the form, then Submit (propose) and Submit to Queue.
- Edits
Click Propose Update on a record, make your changes, then Submit Update (propose) and Submit to Queue.
- Status changes
An obligation's Status button files a proposal through Submit for Review, and approval records the new status and the attestation date. See the Obligations guide.
- Reviews
Record Review on a policy files a proposal carrying the review dates. See the Policies guide.
- Uploads and imports
Evidence and policy document uploads, and spreadsheet imports from Uploads, each become one proposal.
- Copies and reported incidents
Make your own on a shared record files a proposal for the copy, and converting a report from the public incident reporting form creates one for the new incident.
Approval depends on your role, the org units a proposal touches and your sensitivity access.
- Role
Owners and admins only. Members can create proposals but not decide them.
- Org units
An admin can see and decide a proposal only if they can see every org unit it touches: the record's current unit, and any unit it would move to or be shared into. Owners see the whole organisation.
- Sensitivity
A proposal with Confidential or Privileged content, or one that makes a record Highly sensitive, is hidden from anyone without that access, and they cannot approve it.
- Your own proposals
You can approve your own by default, and the proposal is then badged Self-approved.
Owners and admins decide a pending proposal from its own page, which shows exactly what approval will write.
- 1
Open the proposal
Click Review in the queue, or Open on a proposal in the Dashboard's My actions.
- 2
Check the change
For a new record the diff card lists every field; for an edit it shows Before and After for changed fields only. Changes to who can see a record, such as its business unit or classification, appear as rows too.
- 3
Click Approve or Reject
The buttons sit at the top right of the proposal's page.
- 4
Click Confirm
You then return to the queue.
What each decision does
- Approve
Writes the change at once. There is no undo: reversing it takes a new proposal.
- Reject
Nothing in the register changes, and the proposal stays in the queue as Rejected. Rejecting a new evidence or policy upload also discards the uploaded file. There is no rejection reason field, so tell the proposer why.
A spreadsheet import and a record drafted with the AI assistant reach the register through the same queue.
A spreadsheet import from Uploads arrives as one proposal holding every row, and it always creates new records rather than updating existing ones. The proposal shows each row with its mapped values, and flags any value that will be changed on import. See Spreadsheet import.
- 1
Check the mapping
Open Column mapping and confirm each field came from the right column.
- 2
Remove bad rows
Click the bin icon beside a row. Rows can be removed but not edited: fix a wrong value by uploading again, or edit the record after approval.
- 3
Approve
An Import outcome card reports how many rows were created, skipped and coerced. A row with no title is skipped. If an approval creates nothing, the proposal stays Pending so the bad rows can be removed and it can be approved again.