A short reference for reviewing business-built applications before production deployment, broader rollout, or connection to corporate systems. This acts as an auxiliary guide to the authoritative Confluence-based Custom Business App Approval Playbook.

When approval is required

Route an application for review when a non-AI-Operations colleague is deploying or scaling an application, especially when it:

• Uses customer, employee, financial, confidential, or other sensitive data.
• Connects to Okta, Glean, Salesforce, Jira, warehouses, or other corporate systems.
• Is intended for production, public-facing use, or a broad internal audience.
• Uses AI or LLM services in a workflow that needs governance review.

Review inputs

Ask the requester to provide the app scope and, where applicable, the Docebo App Checklist. Review:

• Audience and business criticality.
• Data sensitivity and storage.
• Integrations and read/write permissions.
• AI or LLM usage, models, and prompt-injection considerations.
• Cost, ownership, support model, and deployment target.
• Authentication, authorization, secrets handling, repository, and dependency posture.

Decision outcomes

• Approved: The app may proceed within the reviewed scope and approved controls.
• Approved with conditions: Specific changes are required before deployment or expansion.
• Rejected or redirected: The proposed path is not approved; the request may need a different architecture, a CB/CBX build, or another service desk.

Baseline guardrails

• Do not place secrets in prompts, tickets, repositories, or logs.
• Use approved repository and deployment patterns for governed citizen-developer applications.
• Use least-privilege, preferably read-only, access for production data.
• Lovable is not cleared for public-facing or customer-data hosting; use the approved alternative path after review.
• Involve Security and Legal / Compliance when the data, audience, integration, or hosting model requires it.