Approval Flows
An approval flow decides who has to say yes before someone gets access to a resource. You build the flow once, then link it to as many resources as need the same sign-off in Resource Management.
When to Use Approval Flows
- You want access requests to require manager sign-off before provisioning
- Different resources need different approval processes (e.g., sensitive data needs a security lead, standard tools only need the manager)
- You need several people to approve, in any order or in a fixed sequence
- Compliance requirements say specific roles must authorize access
The Configured Flows Table
The page lists every flow with its Flow Name, Description, Approvers summary (for example "2 job titles, 1 user"), Approval Mode, and Status. A flow with a single approver shows "Single approver" in the mode column, and an ordered flow shows "All in order".
Each row has three actions:
- View opens the flow read-only
- Edit opens the same panel with every field editable
- Delete asks for confirmation, then removes the flow permanently
Click Add Workflow to create a new one.
There is no duplicate action. To build a flow that is close to an existing one, open the existing flow with View, note its approvers, and create a new flow with Add Workflow.
Creating an Approval Flow
Click Add Workflow to open the side panel. Workflow Name and Description are both required; the Add Workflow button in the panel stays disabled until both are filled in.
Name and Description
Use a name that says what the flow does, like "Finance apps - manager then CFO" or "Standard tools - manager only". Administrators pick flows by name when they link them to resources, so a vague name like "Flow 2" costs time later.
Approvers
You can mix four approver types in one flow.
| Approver type | How you add it | Who can act |
|---|---|---|
| Specific users | Select Specific Users opens a search of your users. Click a user to add them, click again to remove. | Exactly the users you picked. |
| Job titles | Select Job Titles opens a searchable list of the job titles that exist in your directory. | Anyone whose job title matches. The match ignores upper and lower case but must otherwise be exact. |
| Boss (Manager) | Toggle the Boss (Manager) button. | The requester's manager, looked up when the request is submitted. If the requester has no manager, the resource owner takes the manager's place. |
| Resource Owner | Toggle the Resource Owner button. | The owner set on the resource being requested. |
Boss (Manager) and Resource Owner are placeholders. They don't name a person in the flow, they resolve per request. That is why one flow with "Boss (Manager)" works for the whole company.
Selected approvers appear in a list below the buttons, each labeled with its type (Job Title, User, or the placeholder name). Remove one with the X next to it.
Approval Mode
The Approval Mode field appears once the flow has more than one approver. A flow with a single approver doesn't need one.
One of these Any one of the approvers can approve, and the request moves on as soon as one does. If an approver denies before anyone approves, the request is denied. Use it when any of several people is good enough, like "any team lead".
All of these Every approver must approve, in any order. One denial ends the request. Use it when several people have to agree, like the system owner and the security lead.
All of these in order Approvers act one at a time, in a sequence you set. Each approver becomes their own stage: the second approver isn't asked until the first has approved, and a denial at any stage ends the request. Use it for escalation chains, like manager first, then the department head.
Setting the Order
When the mode is All of these in order, the approver list becomes draggable. Grab an approver by the handle on the left and drop it where it should sit in the sequence. The panel shows the hint "Drag to reorder the approval sequence."
The order is saved per approver type. Job titles always come first, then Boss (Manager) and Resource Owner, then specific users. Within each type, the order you drag them into is kept. If you need a specific user to approve before a job title, there is currently no way to set that up. Check the order with View after saving.
Status
A flow is Active or Inactive. Inactive flows don't show up in the Approval Workflow list when you create or edit a resource. Resources that are already linked to an inactive flow keep using it for new requests, so switching a flow to Inactive does not stop it. To take a flow out of use, link its resources to another flow first.
What Requesters and Approvers See
When someone requests a resource linked to your flow, the approvers for the first stage get a notification in the portal. If Approval email notifications is on in Notifications, they also get an email with a direct link to the request. The approver opens the request, sees every stage and who has acted, and approves or denies. See Requesting and Approving Access for the full approver experience.
Nobody can approve their own request, even if they are listed as an approver in the flow.
Linking Flows to Resources
You connect a flow to a resource in Resource Management. Each resource uses either one approval flow or Auto Approve. Several resources can share a flow.
At least one approval flow must exist before you can create resources or organizational units. Resource Management keeps those buttons disabled until then.
Deleting a flow doesn't check whether resources still use it. Those resources keep pointing at a flow that no longer exists, and new requests for them skip the approval stages and land in Pending Requests for an administrator to decide. Move the resources to another flow before you delete one.
Best Practices
- Keep flows as simple as the risk warrants. Most resources need one approver, not three stages.
- Prefer Boss (Manager) over named users. It follows your org chart, so you don't have to edit the flow when people change teams.
- Make sure everyone who approves by job title has the Access Center User role. They can't act on requests without it.
- Name flows by what they do, so whoever links them to resources can pick the right one.
- Test a new flow on a low-risk resource before you put it on anything sensitive.
Troubleshooting
If a request is stuck waiting for approval:
- Open it from the requester's Access Center and check the "Waiting for" line to see who it's waiting on
- For "All of these" flows, every approver must act. One person on holiday blocks the request.
- For Boss (Manager), check that the requester has a manager set in your directory
If the wrong person is asked to approve:
- For Boss (Manager), check the requester's manager attribute
- For job titles, check the spelling of the approver's job title. "Team lead" and "Team Lead" match, "Teamlead" doesn't.
If a flow isn't being used:
- Check that at least one resource in Resource Management points at it
- Check that the resource has Auto Approve turned off. Auto Approve skips the flow entirely.