Approval
The Approval object/work item: a decision request routed to an approver.
An Approval is a work item asking a person to approve or reject an access change, recorded for audit.
- What the Approval object represents
- Key attributes and relationships
- How it is created and maintained
- Where it appears in governance
An Approval is a work item that asks a specific person to approve or reject an access change, and records their decision for audit. Approvals are the human checkpoint in access requests, provisioning and policy exceptions, and their design determines whether sign-off is a real control or a formality.
What an approval represents
Each approval is a pending decision routed to an approver. The approver can approve, reject, or forward/reassign it, ideally adding a comment. The outcome drives the next step, provisioning on approval, closure on rejection, and is written to the audit trail.
Routing and ownership
Approvals are routed by ownership or workflow logic: to a role owner, an application/resource owner, the requester’s manager, or a defined approver chain. The guiding principle is to route to someone with the context to actually judge the request, not a distant manager who will reflexively approve.
Escalation and accountability
If an approver does not act within a defined time, the approval escalates, to a backup or up the chain, so inaction cannot silently block a new hire’s access. Escalation also creates accountability: an unactioned item is visible and reassigned rather than lost.
Approvals as audit evidence
Every approval decision, with approver, timestamp and comment, is logged. This record demonstrates that access changes went through a controlled, human review, which is exactly what auditors want to see.
Common pitfalls
- Approval fatigue leading to rubber-stamping; scope approvals to genuinely sensitive access.
- Routing to uninformed approvers.
- No escalation, letting one unresponsive person stall the process.