Organization policies

Organization policies set shared rules and restrictions for how people and agents use withHuman across your organization.

Reviewer sign-in

Ask reviewers to sign in again after sets how long reviewers can approve or deny requests before they need to sign in again. The default is 30 days. Shorten it if your organization wants reviewers to prove who they are more often.

Separately, a browser session lasts 7 days and a session in the withHuman phone app lasts 30 days. After that, people sign in again.

Multi-factor authentication (MFA) requires an extra check when signing in. Optional does not require it. Required for reviewers and Required for everyone currently apply the same MFA checks.

Current limitation: withHuman's built-in sign-in methods, including SSO, do not yet support these checks. Keep Optional selected when using them. Either required setting prevents these reviewers from approving or denying requests.

Your own agents' requests

People can approve or deny requests from their own agents whenever routing reaches them. To send each personal agent's requests to the person who runs it, choose the agent's owner in an approval pipeline.

For independent review, send those requests to an escalation path of other people instead, and limit permission for decisions outside routing.

Claims

Release a claim after sets how long a reviewer can hold a request while reviewing it. The default is 15 minutes; the maximum is 1 day.

A claim pauses escalation. When it ends, escalation resumes if the request still needs a decision. See Request claims.

Changing this duration affects new claims only.

Unrouted requests

Unrouted requests controls who can decide requests that have no escalation path.

• Any reviewer: anyone with permission to approve or deny can decide it.
• Break-glass only: a reviewer also needs permission to make emergency decisions. They must confirm the exception, which is recorded in Audit log.

flowchart TD
    request["Human review without an escalation path"] -->|Any reviewer| ordinary["Approval permission"]
    request -->|Break-glass only| emergency["Approval and emergency decision permissions"]

Example: Unassigned refunds

We'll use Break-glass only so a refund without an escalation path needs an emergency decision.

Request visibility

Request visibility controls what members with permission to read requests can see:

• Everyone with request access: readers can see all requests.
• Only the people it was routed to: readers see requests assigned to them or their teams. Requests without an escalation path remain visible.

Owners, auditors, and anyone with permission to view others’ requests can still see all requests.

Seeing a request does not give someone permission to approve or deny it. See Permissions.

Programmatic access

You can allow or disable organization API keys and personal API keys separately.

Turning off a key type stops people creating or using those keys, including keys already issued.

Existing keys are kept. Turning the setting back on allows valid keys to be used again.

Saving and access

Saved changes take effect immediately, including for requests waiting for review.

You need permission to change organization settings. Audit log records each change.