Implementation methods

Every saving runs through one implementation method. You pick it from the Implementation method list in the recommendation drawer, before you approve. The drawer's Implementation step then shows what that method still needs.

Method	What happens	What it needs
Automated Savings	LevelFour applies the change in your cloud account	A connected access grant for this saving
IaC Pull Request	LevelFour opens a pull request with the code change, and you merge it	A connected GitHub or GitLab organization and at least one repository
Automated Savings + IaC Pull Request	LevelFour applies the change, then opens a pull request with the matching code so your IaC state does not drift	Both of the above
Manual Setup	You apply the change yourself from step-by-step instructions	Nothing from LevelFour

Approve Savings stays disabled until the chosen method has what it needs.

Once a saving is approved, its method is locked. The one exception is a failed run, which re-opens the choice so you can retry with the same method or another.

Automated Savings

Automated Savings acts through a grant: scoped, time-limited access that covers exactly the actions and resources of one saving, and expires on its own.

Choose Automated Savings

In the drawer's Implementation method list, pick Automated Savings.

Authorize in AWS

Select Authorize in AWS. CloudFormation opens in your AWS account with a stack that attaches this saving's permissions to the LevelFourSavingsExec role. The panel states how many actions and resources the grant covers. Create the stack.

Wait for Access granted

The panel reads Waiting for approval until AWS reports the stack back to LevelFour, then Access granted. Approvals and rollout lists every state a grant can be in.

Approve

Approve Savings unlocks once access is granted.

To apply the permissions yourself instead of launching the stack, expand Set up manually. It shows the IAM role and the IAM policy JSON for this saving.

An account onboarded before the LevelFourSavingsExec role existed shows One-time setup required. Create the role once with Automated Savings setup, then run the action again.

IaC Pull Request

Choose the organization

Pick IaC Pull Request. Under Version control and organization, choose a connected GitHub or GitLab organization, or select Connect organization to add one. GitHub and GitLab cover connecting each.

Choose the repositories

Under Repositories, pick the repositories that define this resource. Repository missing? Manage access opens that organization's connection page in the dashboard, where you give LevelFour access to another repository.

After approval, LevelFour opens the pull request in the repositories you chose. IaC Pull Request supports Terraform and CloudFormation.

Automated Savings + IaC Pull Request

This method applies the change in your cloud first, then opens a pull request with the matching code, so the next plan of your infrastructure code does not undo it. It needs a connected grant and at least one repository before it can be approved. Follow both sections above.

Manual Setup

The Implementation step shows the instructions for this saving, with the commands to run in your own cloud console.

When you have applied the change, open the row menu on the Savings page and select Mark as completed. The saving moves to Saved and appears in Savings Audit.

From other surfaces

The MCP server records a method with set-implementation-method and mints a grant with create-savings-grant. See Tools
l4 rec execute requests execution with a method from a terminal

On this page