PrivateNexus treats infrastructure changes as governed actions, not silent shell commands — every action that can affect a real service goes through the same propose → review → approve → execute flow.
Say you want to restart a service that's showing a degraded health check.
The same shape applies whether the action is a one-click restart or a multi-service Catalogue deployment — only the size of what's being reviewed changes, not the flow itself.
Not every action carries the same risk, so not every action is treated the same way. Each action type has a real policy behind it:
Low-risk, routine actions can be configured to execute without a separate approval step. Higher-risk ones can't — that boundary is a policy decision, not something an individual action can opt out of.
Dual-control (one person proposes, a different person approves) is the default, but it's automatically relaxed for accounts where no second reviewer exists on record — a solo operator isn't blocked from approving their own routine actions. The moment a second real person is added to the account, dual-control re-tightens automatically. Every self-approval under this relaxation gets its own distinct audit entry, so it's never indistinguishable from a real second-reviewer approval after the fact — anyone reviewing the audit log later can tell exactly which approvals were self-approvals under the relaxation and which had genuine independent review.
PrivateNexus also runs background discovery agents (Docker, Proxmox, Caddy) that scan for things running on your infrastructure that aren't yet registered or governed. Anything found lands in a review queue — approve it to bring it under governance, or dismiss it if it's not something you want tracked. See Discovery for more detail.