Every guide to adding an approval step assumes you own the source. The software that worries your risk committee is usually the software you bought, and the vendor's roadmap for the control you want is not your roadmap.
What it changes for the business
- You stop waiting on a vendor. A control your supplier has no plans to build becomes something you apply this quarter, without their agreement.
- Third-party tools become deployable. The purchase that stalled because it could act without oversight can go ahead with oversight you added yourself.
- No integration project. There is nothing to build into the product, so the cost is a policy change rather than an engineering commitment.
- One control across everything. The same rule covers bought software, your own services and agents, so there is one thing to explain to an auditor.
How it works, briefly
The control sits where the software's outbound calls already leave your environment, so nothing has to be added to the software itself. The person asked sees what was really requested, described in plain language, rather than a summary the calling system supplied about itself.
| How this is handled elsewhere | How Squidder does it |
|---|---|
| Build approval into the application | Nothing added to the application |
| Wait for the vendor to ship the feature | Applied without the vendor |
| Wrap it in a workflow tool it must call | Works whether or not it cooperates |
| Trust the calling system's description | Reconstructed from what it actually sent |
| One control per product, each different | One control across every product |
about itself
the person sees this one
Where it fits, and where it does not
Something with no person behind it cannot be asked. Unattended machine traffic needs a policy decision instead, which is a different control and is treated as one rather than pretending software can consent on a person's behalf.
Where to start
Pick the bought product your security team is most uncomfortable with. Put a control in front of one destination it calls, change nothing about the product, and see whether the discomfort survives.