← Back

Capabilities

Human approval that does not fall over in production

Most approval designs hold the request open while a person decides. That works in a demo and fails the first time somebody approves something after lunch.

Putting a person in the path sounds simple until it meets real infrastructure. Something has to wait, and everything between your application and the internet has an opinion about how long it is willing to wait. Usually about sixty seconds.

Hold the connection
60s: idle timeout, the request fails here
Refuse, ask, retry
refuse & ask, nothing held
retry, completes
0 47 min: the person answers 60 min
Both timelines are the same hour. The upper one ends at the first tick.
Fig 10ABoth timelines are the same hour.

What it changes for the business

  • Approvals can take as long as people take. An hour, or overnight, costs nothing, so the control survives contact with actual working days.
  • It scales past the pilot. Pending approvals consume nothing, so a hundred outstanding decisions is the same load as none.
  • Restarts and deploys are safe. Maintenance during a pending approval does not lose it, so the control does not constrain your release schedule.
  • Fewer surprises in production. Nothing sits in a timeout that behaves differently under load than it did in testing.

How it works, briefly

The request is declined immediately, with an answer that says clearly this is not final. The question goes to the person, and the caller tries again, as software already does when something is temporarily unavailable. On the retry it proceeds, or is refused, or is told to keep waiting.

How this is handled elsewhere How Squidder does it
Hold the connection until someone answers Nothing is held open
Approvals bounded by an idle timeout Bounded only by the person
A restart loses whatever was in flight Pending decisions survive it
Slow approvals exhaust the connection pool Pending approvals cost nothing
Works in a demo, fails at volume The same at one or a thousand

Pending approvals

What a hundred outstanding decisions actually cost the gateway.

104 waiting
Outstanding decisions
104
Oldest pending
3h 12m
Connections held
0
Threads blocked
0
Gateway restarts since
2
Decisions lost to them
0
Fig 10BA hundred pending decisions, and nothing held.

Where it fits, and where it does not

The calling software has to be willing to try again. Nearly everything already is, because retrying is how software has always handled a service being briefly unavailable, but a system that treats any refusal as permanent is worth checking once before you rely on this.

Where to start

Trigger an approval and leave it unanswered for an hour while watching your connection count. Nothing is held. Answer it, let the caller retry, and the work completes as though the pause cost nothing.