Auto-approval
By default every submission waits for a person. Auto-approval lets clean ones through on their own, so your queue only holds what needs judgment.
Configure it in Govern → Skills & Plugins → Settings → Auto-approval.
The rules
A submission is approved automatically only when every rule holds:
| Setting | Default | Auto-approves only if… |
|---|---|---|
| Auto-approve clean scans | Off | …this is on. |
| Highest risk score that auto-approves | 20 | …the risk score is at or below this. The scanner's own "safe" band ends at 20. |
| Any finding at or above this sends it to review | High | …no finding is at this severity or worse. |
| Also auto-approve plugins that bundle hooks, MCP servers or scripts | Off | …the plugin contains no code that runs on its own — unless you turn this on. |
| Apply to admin uploads | On | …it was uploaded by an admin. |
| Apply to member requests | On | …it was requested by a member. |
The scanner's verdict must also be Safe.
Do-not-install verdicts
When the scanner says "do not install":
| Option | Effect |
|---|---|
| Send to review (default) | A person decides. |
| Reject automatically | Rejected on the spot, with the reason recorded. An admin can still Approve anyway. |
Scans that didn't finish
If a scan fails, finds nothing to read, or hasn't come back within 15 minutes, the submission always goes to a person — auto-approval and auto-reject both need a completed scan.
Member requests
Let members request skills and plugins turns Request one on or off in Connect → Skills. Requests land in the same queue and follow the same rules.
Every decision is recorded
The policy's decisions carry a reason — for example "Auto-approved by policy: scanner verdict safe (0/100)" or "Has a high finding — high+ always gets a person" — shown in the drawer, to the requester, and in your audit log. Policy changes are audited with the old and new values.