Approving a request before it goes

By default anybody who can compose a request can send it. If you would rather a second pair of eyes saw a client-facing document first, turn on "Approval before sending" under Settings, Security and privacy.

What it does

While it is on, a request cannot be sent until an administrator or the owner approves it. The refusal is on the request itself, in the same list that tells you a recipient has no email address, so whoever is composing sees it where they would see anything else standing in the way.

Anybody can ASK for approval, including somebody who cannot give it. That is usually the point: the person who composed the request is the one who needs somebody else to look. The ask is written down first and the approvers are emailed second, so it is recorded even on a deployment with no mail server. The request page tells you which of the two happened.

An approval covers the request as it stood

If the request changes after it is approved (a different document, another recipient, a change to who signs what) it needs approving again, and the readiness list says so in those words rather than as though nobody had ever approved it.

That is not a precaution. An approval that survived somebody swapping the document would put a senior name on a send nobody senior had seen.

If you are the only administrator

You can approve your own. Refusing would make the control unusable for a firm of one rather than safer. The record says the approval had nobody else to review it, and the page tells you that before you go ahead rather than afterwards.

What it does not do

An approval is your firm's own record. It does not appear on a signer's certificate: a certificate names the person, the check enforced on them, and when. Who inside your firm cleared the send is nobody else's business.