Introduction

Approval groups can be used to manually group a bunch of Core Identity into a group that then serve as an approval group for assignements of either a Role or a Resource. Whenever a new assignement between a Core Identity and such a role or resource is set, the members of the approval groups reveive a notification and are asked to either approve or decline this assignment. If multiple approval groups are set, then the approval of each group will be required.

Properties

When adding or configuring an approval group to a Role or a Resource, you are presented with the following properties:

All members must approve

This means that every single member of the approval group must approve the role application. If at least one member vetoes, the role will not be assigned. If the option is not activated, the approval of one member of the approval group is sufficient.

Approve automatic assignments

This means that roles that are automatically assigned to a core identity due to its employment should be checked again manually by members of the Approval Group.

Approve manual assignments

Means that roles that have been manually assigned to a core identity are to be checked again manually by members of the Approval Group.

If neither Approve automatic assignements nor Approve manual assignments is checked, the approval group will not have any effect. You can use both of them at the same time, or either one or the other.

Include manager & include line manager

When configuring Approval groups within Master data management, you may optionally activate either of these two features:

Including the manager will automatically add the Core Identity configured to be the assignee’s manager to the approval group, if a manager is set.

Including the line manager will automatically add the Core Identity identified to be the assignee’s next superior using the organizational structure (see Organizational unit), if it can be resolved.