Part of the agreed Engineering Implementation Tasks from the [February 2026 GA roadmap](https://gitlab.com/groups/gitlab-org/-/work_items/9429#note_3101433934): > All users of the GitLab instance can be awarded badges, but an explicit approve action is required to accept an awarded badge. Continues the effort started in [#390389](https://gitlab.com/gitlab-org/gitlab/-/issues/390389). ## What - **DB migration**: change the default of `show_on_profile` on `achievements_user_achievements` from `true` to `false`, so awarded badges do not appear on a user's profile until explicitly accepted. Migration is already prepared in !227918 (originally from #593737, closed in favour of this issue). - Update the award e-mail notification to make it clear the recipient must ACCEPT or DECLINE - Implement accept/decline actions. Similar to the "unsubscribe" pattern in GitLab notifications: follow a link, perform the action, redirect with a flash confirmation. - **Accept**: sets `show_on_profile: true` on the `UserAchievement` record - **Decline**: deletes the `UserAchievement` record Probably in a follow-up: - Surface badges awarded but not yet accepted (`show_on_profile: false`) in the user's profile settings so they can act on them there too ## Notes - #593737 was closed in favour of this issue. The migration belongs here. - Opt-out of being awarded entirely is out of scope here. That is covered by #593740.