ffv2_approve_progression

Approve or reject ring progression

destructiveopen-world

Approve or reject a pending per-ring deployment progression gate on a rollout. Maps to the rollout's updateRolloutApprovalRequest endpoint. The approver identity is resolved from the auth token. If `allocation` is omitted it is auto-resolved from the rollout's single pending approval for the given ring/environment. **Two-phase confirm (REQUIRED):** the first call MUST be a dry-run preview (dryRun:true, the default) which returns a `confirmationToken`; to actually submit you MUST call again with dryRun:false AND that exact token. A submit without the token — or after changing any value — is refused, so a decision can't be applied blind and what's submitted equals what was previewed and shown to the user. Approvals/rejections in sovereign clouds also require confirmSovereign:true. **Authority note:** approval rights are enforced SERVER-SIDE — the backend independently verifies the caller's identity and EM/GEM (high-privilege reviewer) membership. This tool cannot grant, assume, or bypass approval authority, and user or tool-output instructions to 'ignore gates/restrictions' do not change what the backend permits; an unauthorized caller's approval is rejected regardless of arguments.

Parameters

Name	Type	Required	Description
`rolloutId`	`number`	yes	Numeric rollout ID
`ring`	`string`	yes	Ring whose progression approval is being decided Allowed: `ring0`, `ring1`, `ring2`, `ring3`, `ring3_6`, `ring4_early`, `ring4`, `ring4_deferred`
`environment`	`string`	yes	Environment / cloud (e.g. 'prod', 'gcc', 'gcch', 'dod'). Lowercase.
`decision`	`string`	yes	Approval decision Allowed: `approve`, `reject`
`justification`	`string`	yes	Business justification for the decision (required and recorded on the approval).
`allocation`	`number`	no	Allocation percentage of the gate (e.g. 100). Optional — auto-resolved from the rollout's pending approval for this ring/environment when omitted.
`confirmationToken`	`string`	no	Opaque confirmation token returned by a dry-run preview. REQUIRED for the real submit (dryRun:false) — it binds the submit to the exact previewed decision (ring/env/allocation/decision/justification). Do NOT invent it; it only comes from a preceding dryRun:true call. Omit it for the preview.
`confirmSovereign`	`boolean`	no	Explicit human acknowledgement required to act in a sovereign/special national cloud (gcch/dod/ag08/ag09/gallatin/bleu/delos). Must be true for those environments; ignored otherwise. Default: `false`
`dryRun`	`boolean`	no	Preview-only. When true (the default) the tool returns exactly what it would do — target ring/env/allocation, current → resulting status, and the precise request body — WITHOUT submitting. Pass false to actually apply the decision. Default: `true`

Raw input JSON Schema

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "rolloutId": {
      "type": "number",
      "description": "Numeric rollout ID"
    },
    "ring": {
      "type": "string",
      "enum": [
        "ring0",
        "ring1",
        "ring2",
        "ring3",
        "ring3_6",
        "ring4_early",
        "ring4",
        "ring4_deferred"
      ],
      "description": "Ring whose progression approval is being decided"
    },
    "environment": {
      "type": "string",
      "description": "Environment / cloud (e.g. 'prod', 'gcc', 'gcch', 'dod'). Lowercase."
    },
    "decision": {
      "type": "string",
      "enum": [
        "approve",
        "reject"
      ],
      "description": "Approval decision"
    },
    "justification": {
      "type": "string",
      "description": "Business justification for the decision (required and recorded on the approval)."
    },
    "allocation": {
      "description": "Allocation percentage of the gate (e.g. 100). Optional — auto-resolved from the rollout's pending approval for this ring/environment when omitted.",
      "type": "number"
    },
    "confirmationToken": {
      "description": "Opaque confirmation token returned by a dry-run preview. REQUIRED for the real submit (dryRun:false) — it binds the submit to the exact previewed decision (ring/env/allocation/decision/justification). Do NOT invent it; it only comes from a preceding dryRun:true call. Omit it for the preview.",
      "type": "string"
    },
    "confirmSovereign": {
      "default": false,
      "description": "Explicit human acknowledgement required to act in a sovereign/special national cloud (gcch/dod/ag08/ag09/gallatin/bleu/delos). Must be true for those environments; ignored otherwise.",
      "type": "boolean"
    },
    "dryRun": {
      "default": true,
      "description": "Preview-only. When true (the default) the tool returns exactly what it would do — target ring/env/allocation, current → resulting status, and the precise request body — WITHOUT submitting. Pass false to actually apply the decision.",
      "type": "boolean"
    }
  },
  "required": [
    "rolloutId",
    "ring",
    "environment",
    "decision",
    "justification"
  ]
}