# Protected sets and reviews

> Protect a team rule or mock set so editors' changes become proposals that a manager reviews and approves, with self-approval refused and every Mac checking the approval.

Source: https://docs.subcloak.com/cloak-proxy/team/protected-sets/

Added in Cloak Proxy 0.7.0.

{/* L9 draft. Sources: PLAN 7.7, 7.14 (Require review policy), 10 (Reviews window, Propose Change…); T9. Re-check labels against L8. */}

A **protected** rule or mock set changes only through review. Editors propose changes, a manager approves them, and every member's Mac checks the approval before it applies the change. Use it for sets that affect everyone's traffic, such as shared staging mocks.

## Protect a set

{/* PLAN 7.7 */}

A manager of the set opens its **Info** sheet and turns on **Protected**. From then on:

- Editors' saves become **proposals**. The **Save** button reads **Propose Change…**, which opens a sheet with a title, a note and the diff.
- Managers get a **review requested** notification.
- **Managers may change it without review** (bypass) is off by default. A manager can turn it on for the set, unless the policy below forbids it.

The sidebar marks a protected set with a shield.

## Review a proposal

{/* PLAN 7.7, 10 */}

1. Open **Reviews** in the sidebar under **Team: Acme**, or from the **Team** menu. The count shows how many are open.

2. Choose a proposal on the left: its title, author, set and age. The diff is on the right.

3. Choose **Approve**, **Request Changes** (which adds a comment) or **Decline**.

An approved change is written with a reference to the approval, and applies on every member's Mac that has the set switched on. Because a manager approved it, it applies even when it runs code or reads files on the Mac, such as a script.

## What's checked

{/* PLAN 7.7; T9; PLAN 12.3 item 9 */}

- **No self-approval.** A manager can't approve their own proposal. The server refuses it, and every Mac skips it.
- **The approval must match.** Each Mac checks that the approval was signed by a manager of the set and covers exactly the change it's attached to. A forged or reused approval is skipped.
- **Direct writes are refused.** An editor's direct change to a protected set is refused by the server, and a Mac skips any unapproved version that gets through.

Because the check runs on every Mac with the team's signatures, Subcloak's server can't approve a change, and neither can a member who isn't a manager of the set.

## Require review for everyone

{/* PLAN 7.14 row 1 */}

The [policy](https://docs.subcloak.com/cloak-proxy/team/policies/) **Require review for protected sets (no bypass for anyone)** stops anyone, admins included, from turning on bypass. It's enforced by Subcloak's server, which refuses access lists with bypass on, and by each Mac, which refuses them while the policy is on. The review rule itself is enforced by signatures, whatever the policy says.

## Related

  - [Spaces, roles and permissions](https://docs.subcloak.com/cloak-proxy/team/spaces-and-roles/): Viewer, Editor and Manager.
  - [Comments and notifications](https://docs.subcloak.com/cloak-proxy/team/comments/): Review notifications and comment threads.
  - [Version history](https://docs.subcloak.com/cloak-proxy/team/version-history/): Restore an earlier version of a set.