Introduction
Pause the automation pipeline at a specific point and wait for a technician to manually approve before execution continues. Use this action when a step carries enough risk that you want a human checkpoint before it runs.
Wait for Approval Action
From the automation pipeline in edit mode, click + and select Wait for approval from the Flow category.
This action has no configuration fields. Add it to the pipeline and position it where you want the approval gate to occur.
💡 TIP: Place Wait for Approval immediately before high-impact actions — destructive changes, mass uninstalls, or anything you wouldn’t want running unattended. It’s a low-overhead way to add a human review step without building a separate approval workflow.
Approve or reject waiting devices
When a device reaches this action, its run pauses until a technician approves or rejects it. Open the Wait for approval action details to manage the waiting runs.
Click Approve all or Reject all to apply the same decision to every device currently waiting at this action.
To decide one device at a time, select the Devices tab. Find the device, then click Approve or Reject. The decision applies only to that device's run.
Click the arrow on a device row to open that run's details before deciding.
Conditions
The Conditions section lets you restrict when this action runs based on device attributes or the outcome of a previous action.
See Action Conditions for the full reference on condition types, operators, and values.
Additional Options
Expand Additional options for action name, failure behavior, output variable assignment, retries, and the enabled toggle.
See Actions Overview for the full reference on additional options available on every action.
FAQ
Where do I approve or reject a pending run? Open the action details. Use Approve all or Reject all for every device currently waiting at that action, or select Devices to approve or reject one device at a time. You can also manage one run from the Automations tab in that device's details.
What happens to the run while it’s waiting? The pipeline is paused for that device. Other devices in the same run continue through their pipelines independently.
Does the run expire if nobody approves it? No — pending approvals don’t expire. The run waits indefinitely until a technician approves or rejects it.
Do technicians get notified when a run is waiting for approval? No — there’s no automatic notification. Technicians need to check the automation run history or device automations view to see pending approvals.
Who can approve or reject a pending run? Technicians with permission to manage automations in the relevant group. See Workspace → Permissions for access control configuration.
Can I use this to approve each Windows or macOS update before it installs? Level doesn’t currently use a workflow where you manually approve each individual patch before deployment, and this action can’t review or select individual updates. Instead, Level uses a delay based patching model. On the install updates action you choose which categories of updates you want to install and configure a delay for each category. For example, you might delay service pack updates for 14 days after release. This gives an update time to bake before it reaches your environment and gives you an opportunity to identify any widely reported issues. If you become aware of a problem with a particular update during that period, you can globally block that KB under KB Exclusions to prevent it from being deployed. Another approach is update rings: a small group of lab or test devices receives updates immediately or after a very short delay, and your broader production fleet receives the same updates after a longer delay. That gives you an opportunity to validate updates against your own environment, and to block an affected KB before it reaches production.