Require approval before members write to an org

Before you begin

This control is available in a Team workspace. You must be a workspace administrator to turn it on or decide requests.

Use the single Salesforce org approvals policy to choose which environments require review:

• No approval required lets members connect any org without workspace-admin review.
• Production orgs only governs production while letting sandboxes, Developer Edition orgs, and scratch orgs connect without approval. This is the recommended option.
• Non-production orgs only is available for teams that need the inverse policy.
• All Salesforce orgs also governs non-production environments.

Approval is off by default. Personal Pro workspaces do not require this approval because there is no separate workspace administrator to review the owner.

The process

1. An administrator chooses the Salesforce org approval policy.
2. A member connects the Salesforce org and tries to use it.
3. Org Loom creates an org-access request for that member.
4. An administrator approves or denies the request.
5. An approved member retries the action.

Approval is specific to one member and one Salesforce org. Approving a person for one org does not approve another person, and it does not approve that person for a different org.

Step 1: Turn on the approval requirement

From the canvas, select the workspace button and open Workspace settings. On the Workspace tab, find Workspace settings, then choose which Salesforce orgs require approval.

The setting applies to the next protected action. It does not interrupt an upload that is already running. It also applies to connections that members created before the setting was enabled.

Step 2: Let the member request access

The member connects to Salesforce normally. When Org Loom first checks a protected action for that org, the member sees that administrator approval is required. That blocked attempt creates the request automatically, so there is no separate request form.

While the request is pending, the member can continue preparing their work. Actions that require the governed Salesforce connection remain blocked until approval is granted.

Step 3: Review the request

Pending requests appear under Salesforce org access on the Workspace tab.

Review the member and Salesforce org, then choose:

• Approve to let that member use the governed org from this workspace.
• Deny to keep access blocked. You can add an optional note that the member can see.

Current approvals appear in the same section, where a workspace administrator can revoke access for a specific member and org.

Step 4: Retry the protected action

After approval, the member retries the action and continues normally. A denial keeps the action blocked. If the member tries again later, the existing request returns to pending instead of creating a duplicate.

Approval does not replace Salesforce security. The member still acts through their own Salesforce user. Object, field, sharing, validation, and other Salesforce permissions continue to apply.

Changing or removing access

• Revoking a member's approval blocks their next protected action again. It does not undo work that already reached Salesforce.
• Choosing No approval required removes the workspace-level approval requirement. Existing approvals remain available if approval is required again later.
• Choosing Production orgs only means a new or refreshed sandbox does not need an approval entry.
• Choosing All Salesforce orgs requires a new approval after a sandbox refresh because Salesforce assigns the refreshed sandbox a new org ID.

Review the decision history

Approvals, denials, permission changes, and feature-setting changes appear in Activity History. Use it to confirm who made a decision and when it occurred.

See also

• Managing a Team workspace
• Connecting a Salesforce org
• Reviewing Activity History