Approval levels (P0–P5)

Every action on INVA infrastructure is classified before execution. When unsure, round up. inva-infrastructure/RULES.md is the authoritative statement; this page is the reference copy.

Level	Meaning	Behavior
P0	Read-only inspection	Automatic
P1	Prepare files, plans, branches (no system/cloud change)	Automatic
P2	Safe validation, dry runs, plan (no mutation)	Automatic
P3	Privileged operational change	Stop and request approval
P4	Critical / destructive / owner / billing change	Stop; action-specific approval
P5	Prohibited	Never

P3 examples: package installation; API enablement; VM create/modify; deployment; service restart; DNS changes; Pages production deploy; git push/merge; firewall changes; credential rotation; secret retrieval; WireGuard peer create/remove.

P4 examples: IAM owner/admin changes; billing; repository/project deletion; domain transfer; nameserver replacement; destructive migrations; disabling MFA/logs/backups/security controls; public exposure of administrative services; storage-pool creation on physical disks.

P5 (never): printing/persisting/committing secret values; downloading service-account keys; granting automation owner-level authority; disabling audit logging; exfiltrating internal data.

An approval is valid only for the exact operation, target, and reviewed plan presented.

flowchart LR
    A[Action proposed] --> B{Classify}
    B -->|P0–P2| C[Execute + log]
    B -->|P3| D[Permission request<br/>action/target/rollback/validation]
    B -->|P4| E[Action-specific request<br/>owner decision]
    B -->|P5| F[Refuse]
    D --> G{Owner approves?}
    E --> G
    G -->|yes| C
    G -->|no| H[Record + alternative]