External approvers

Sign-off from people outside your organization.

A stage can list external email addresses instead of an internal role (By email address in the builder). Each address is checked against your team; anyone not in it receives, when the stage activates, an email carrying two credentials:

• A magic link, single-use, valid for 7 days.
• A one-time code (6 digits), valid for 30 minutes.

Opening the link shows a minimal decision page: enter the code, optionally comment, then approve, approve with conditions or reject. No account, no password, nothing to install.

Security model

• The link token is random, single-use, and bound to one assignment.
• The code is the step-up factor: possession of the link alone is not enough.
• Both expire independently; an expired code simply means requesting a fresh email.
• The decision is recorded in the audit trail against the external email address.

When to use it

Client acceptance on deliverables, counterparty sign-off on contracts, landlord or supplier confirmations. Anywhere the decision-maker will never be a user in your workspace.