# Countersign an app's actions

> Turn on Countersign for an app your organization runs, choose how people confirm its sensitive actions, and try it on yourself first.

Source: https://docs.trustaige.com/manage/countersign

Countersign has a person confirm one sensitive action in an app, such as a
change of salary account, a role grant or a deletion, at the moment it
happens. They see exactly what they are agreeing to, and the app receives a
signed record bound to that one action. It protects your apps from someone, or
something, using a person's signed-in session to act in their name.

The app's developers decide which of its actions ask; you decide how people
answer. The developer's side is in [Countersign](/countersign).

## Turn it on

1. In the hub, open **Apps** and choose the app. Countersign is for
   applications your organization runs itself, so the **Countersign** tab
   appears only for those: an app made from a catalog template can't use it,
   because its vendor holds its credentials too.

2. Open **Countersign** and choose how people confirm:

   | | |
   |---|---|
   | **Off** | The app can't ask. |
   | **Passkey** | A Trustaige window opens over the app, on the device the person is using, and they confirm with their passkey. |
   | **Phone** | A notification on the person's phone; they approve in Trustaige Identity. Shown once it is available to your organization. |

   Changing the setting needs a recent sign-in, and is recorded in the audit
   log with the old and new choice.

3. Press **Try Countersign**. You countersign an example action yourself,
   exactly as the app's people will, and see afterwards what they would see
   and every check the app makes on the result, each ticked. Nothing changes
   in the app: a trial's record is made out so that no app accepts it, and the
   audit log shows it as a test.

## What people see

The app's name and your organization's, the action in the app's own words,
and every detail the app sends, with a short reference that is the same on
every screen. People can confirm or decline; declining is as easy as
confirming. An action with many details is shown in full, and is harder to
read: if **Try it** says an action shows more than eight details, ask the
app's developers which ones change the decision.

## When someone didn't ask

On the phone, a person who gets a request they didn't start can tap **This
wasn't me**. The request is declined, a warning appears in your audit log, and
requests to that person pause for 15 minutes, so no one can keep sending them
until someone taps Approve. A trial never pauses anyone.

## In the audit log

| Event | When |
|---|---|
| `verification.approved` | A person countersigned an action. |
| `verification.declined` | A person declined, or picked the wrong code on their phone. |
| `verification.reported` | A person said a request wasn't theirs. |
| `verification.tested` | An admin tried Countersign on themselves. |