Set the guardrails once, not for every change

On Substrait an approval sets a boundary, not a frozen snapshot. Builders change their tool freely inside the boundary, and only a change that crosses it, such as new data, writing instead of reading, or facing customers, goes back for approval.

Last updated 6 November 2026

Risk tiers

Substrait places every tool in a risk tier by what it can affect: read-only, takes actions, or faces customers. The tier sets the approval bar and the rules the tool runs under, for its whole life. Your organisation names its own tiers and severity levels, and Substrait uses your names.

Approval routing

A change that satisfies policy is approved automatically. A change the policy flags is routed to the right approvers, with deadlines and escalation. Approvals can need one person, any of several, or all of several. Nobody approves their own change.

The boundary, approved once

An approval defines limits: which data, read or write, customer-facing or not. Inside those limits, builders keep changing the tool with no new review. A change that breaks a limit goes back through approval. That is how Substrait keeps building both governed and fast.

Sensitive data sets its own rule

For genuinely sensitive fields, your organisation can set a rule on which tools may ship at all if they use them, on top of who may see the data.

Questions and answers

Does every change need a human approver?

No. On Substrait a change that satisfies the organisation's policy is approved automatically. A human approves only when the policy calls for it, typically for higher risk tiers, sensitive data or customer-facing tools.

Who writes the policies?

Your organisation does. Substrait provides the framework and sensible defaults, and your people decide the risk tiers, the approvers and the rules.