Approval

An Approval is a work item that asks a specific person to approve or reject an access change, and records their decision for audit. Approvals are the human checkpoint in access requests, provisioning and policy exceptions, and their design determines whether sign-off is a real control or a formality.

Each approval is a pending decision routed to an approver. The approver can approve, reject, or forward/reassign it, ideally adding a comment. The outcome drives the next step, provisioning on approval, closure on rejection, and is written to the audit trail.

Approvals are routed by ownership or workflow logic: to a role owner, an application/resource owner, the requester’s manager, or a defined approver chain. The guiding principle is to route to someone with the context to actually judge the request, not a distant manager who will reflexively approve.

If an approver does not act within a defined time, the approval escalates, to a backup or up the chain, so inaction cannot silently block a new hire’s access. Escalation also creates accountability: an unactioned item is visible and reassigned rather than lost.

Every approval decision, with approver, timestamp and comment, is logged. This record demonstrates that access changes went through a controlled, human review, which is exactly what auditors want to see.

• Approval fatigue leading to rubber-stamping; scope approvals to genuinely sensitive access.
• Routing to uninformed approvers.
• No escalation, letting one unresponsive person stall the process.