Policy: Require Approval to Run Applications

This example shows a File Access policy that prompts for approval before allowing a user to run an application. It’s useful for demonstrating how to introduce an approval workflow for application execution across a group of endpoints (for example, a pilot group or a department).

---

What this Policy Does

When a user on any in-scope endpoint tries to run an application:

1. The request is evaluated by the File Access policy engine.

2. Because the policy is broadly scoped (all users, all applications), it matches most execution attempts on those endpoints.

3. The policy requires Approval before allowing the action to proceed.

---

Why it Behaves this Way

This policy is intentionally written as a “broad match” policy, then applies a control:

• Enforced: The policy is active and will apply controls (not just log).

• Approval control on success: When the policy matches, it triggers an approval workflow.

• All users: A wildcard user filter makes it apply to any user account on in-scope machines.

• All applications: A wildcard application filter makes it apply to any application being evaluated by this File Access policy.

• Built-in checks: Standard checks (user, machine, file, date/time/day, certificate) are present. If those constraints aren’t narrowed (for example, no date/time/day/cert restrictions are provided), the policy behaves like a broad catch-all for execution on the targeted endpoints.

---

What the User Experiences

• Most application launches on the targeted endpoints will generate an approval request.

• The policy includes a user-facing notification message. If the message references a specific date or one-off event, replace it with something generic (or remove it) to avoid confusion in production.

---

Important Notes and Common Adjustments

• High prompt volume: Because this applies to all applications, it can create a lot of approvals—especially when expanded to many endpoints.

• Narrow the scope if needed:

  • Restrict the application filter to a specific set of executables or paths

  • Restrict the user filter to specific users/groups

  • Add certificate/publisher constraints to treat trusted vs. untrusted software differently

  • Add time/day/date restrictions for staged rollouts or business-hours-only enforcement

---

Example JSON

{
	"PolicyName": "_2_AFileAccess",
	"PolicyType": "FileAccess",
	"PolicyId": "N0N1N2N3N4N5N6N7N8N9N",
	"Status": "enforce",
	"Actions": {
		"OnSuccess": {
			"Controls": [
				"APPROVAL"
			]
		},
		"OnFailure": {
			"Command": ""
		}
	},
	"NotificationMessage": "Starting 3/4/26 approval will be required to run applicaitions not installed by our IT Staff.",
	"NotificationRequiresAcknowledge": false,
	"RiskLevel": 50,
	"Operator": "And",
	"Rules": [
		{
			"RuleName": "UserCheck",
			"ErrorMessage": "This user is not included in this policy",
			"RuleExpressionType": "BuiltInAction",
			"Expression": "CheckUser()"
		},
		{
			"RuleName": "MachineCheck",
			"ErrorMessage": "This Machine is not included in this policy",
			"RuleExpressionType": "BuiltInAction",
			"Expression": "CheckMachine()"
		},
		{
			"RuleName": "ApplicationCheck",
			"ErrorMessage": "This application is not included in this policy",
			"RuleExpressionType": "BuiltInAction",
			"Expression": "CheckFile(false)"
		},
		{
			"RuleName": "DateCheck",
			"ErrorMessage": "Current date is not covered by this policy",
			"RuleExpressionType": "BuiltInAction",
			"Expression": "CheckDate()"
		},
		{
			"RuleName": "TimeCheck",
			"ErrorMessage": "Current time is not covered by this policy",
			"RuleExpressionType": "BuiltInAction",
			"Expression": "CheckTime()"
		},
		{
			"RuleName": "DayCheck",
			"ErrorMessage": "Today is not included in this policy",
			"RuleExpressionType": "BuiltInAction",
			"Expression": "CheckDay()"
		},
		{
			"RuleName": "CertificateCheck",
			"ErrorMessage": "Certificate hash is not included in this policy",
			"RuleExpressionType": "BuiltInAction",
			"Expression": "CheckCertificate()"
		}
	],
	"UserCheck": [
		"*"
	],
	"MachineCheck": [
		"NSBYFNaHnhkIgVIazYhFXA"
	],
	"ApplicationCheck": [
		"*"
	],
	"DayCheck": [],
	"DateCheck": [],
	"TimeCheck": [],
	"CertificationCheck": [],
	"Extension": {}
}