External approvers

Sign-off from people outside your organization.

A stage can list external email addresses instead of an internal role. When it activates, each external approver receives an email carrying two credentials:

• A magic link, single-use, valid for 7 days.
• A one-time code (6 digits), valid for 30 minutes.

Opening the link shows a minimal decision page: enter the code, optionally comment, approve or reject. No account, no password, nothing to install.

Security model

• The link token is random, single-use, and bound to one assignment.
• The code is the step-up factor: possession of the link alone is not enough.
• Both expire independently; an expired code simply means requesting a fresh email.
• The decision is recorded in the audit trail against the external email address.

When to use it

Client acceptance on deliverables, counterparty sign-off on contracts, landlord or supplier confirmations. Anywhere the decision-maker will never be a user in your workspace.