Approvals: asking, deciding, and the queue — Decide from the email

Approval emails carry Review & approve and Decline buttons. Either one opens a small confirmation page showing what you're deciding; pressing the button on that page is what decides. Being asked is the authorization — the link is signed to exactly one ask and one approver, so no login is required. Two deliberate properties: links expire after 14 days, so a forwarded old email can't decide anything; and merely opening the link never decides — corporate security scanners follow every URL in every email, and an approval that decided on click would be decided by robots. Only the explicit press on the confirmation page counts.