Create Approval Workflows

Oracle Access Governance users with the Access Control Administrator or Administrator application role can create approval workflows from the Oracle Access Governance Console.

Create an approval workflow by configuring templates and advanced settings, adding details and owners, and reviewing the workflow before publishing it.

Navigate to Approval Workflow

Sign in to the Oracle Access Governance Console with the appropriate application role. See Predefined Application Roles Reference.
From the navigation icon, click Access Controls , and then Approval Workflows . The Approval Workflows page opens to view and manage the existing workflows.
Click + Create approval workflow.
The Create a new approval workflow page is displayed to configure an approval workflow.

Add a New Approval Workflow

You can customize an approval workflow using the built-in approval templates.

In the Create a new approval workflow page, click the plus icon. The Add a new approval side pane is displayed.
Select one of the built-in templates from the Which type of approval? list. For more information, see Built-In Approval Workflow Templates.
Based on the approval template selected, configure the required fields. See Configure Approval Templates and Advanced Settings.
Continue designing the workflow, if required:
- Add parallel: To add a workflow at the same level and receive an approval request at the same time as the workflow configured earlier.
- Add next: To add stages to the approval workflow that run sequentially. The approval for a previous stage must complete before next stages can be run.
- Select one of the following for parallel approval workflow:
  - All: The stage is marked as 'Approved' only if every template in the stage is approved.
  - Any: The stage is marked as 'Approved' if at least one template in the stage is Approved.
Click Next.

Configure Approval Templates

Configure the approval template fields according to the template type.

Configure the following fields:


Field Name	Description
Owner, Primary Owner, and Business Approvers
Should self approval be allowed?	Click Yes to enable self-approval. Users can approve their own tasks (access requests or access reviews) without an external approver.
Custom User
Which user?	Click the user to whom you want to send an approval task when a custom user template type is selected.
Should self approval be allowed?	Click Yes to allow self-approval, so users can approve their own access rights without an external approver.
Management Chain
Management chain ceiling?	The upper limit of hierarchy beyond which approval requests should not be sent. Select one of the following: Number of levels up Number of levels from top Identity collection
How many levels up?	Enter the number of levels up the approval request should go, starting from beneficiary's manager. The approval request is not sent beyond the defined number of levels.
How many levels down from top?	Enter the number of levels from top the approval request should stop, starting from the top-most role in the organization.
Ceiling identity collection	Identity collection whose members mark the end of the management chain. Approval requests aren't assigned to these members or their managers.
Should the workflow continue when the approval result is rejected?	Click Yes or No to specify whether the workflow continues after a rejection. For example, the beneficiary's manager rejects the request. You can select whether to continue gathering approvals from the Management Chain.
Identity Collection
Approval identity collection	Select an identity collection that should receive an approval request.
Do all members need to approve?	Select if the approval is required by all the members to approve a request. Click Yes to get approval from all members, and No to configure further.
How many members should approve?	Select the minimum number of members required to approve the request before marking it as approved.
Should approvers have veto power?	Click Yes to allow the approval request to be rejected if any single member rejects it. Any one member's rejection acts as a veto, halting an approval workflow and marking it as rejected.
Which identity collection should requests escalate to?	Select the identity collection whose members should receive escalations.
Should self approval be allowed?	Click Yes to enable self-approval. Users can approve their own access rights (access requests or access reviews) without an external approver.

Advanced Settings for Approval Templates

Configure notifications, escalations, expiration, and automatic approval for approval templates.

Configure the following advanced settings, including options for Access Guardrail and segregation of duties (SOD) violations.


Field Name	Description
How many days between notifications?	Duration (in days) before sending a reminder over email.
Do you want to enable escalations?	Click Yes to enable escalations or No to disable them. The default is Yes. This setting is available for all approval templates. The escalation timing and ceiling fields appear only when escalations are enabled.
How many days to wait before escalating the approval request?	If no action is taken within the configured number of days, the request is forwarded and escalated to the next approver. See Escalation Handling.
Which identity collection should never receive escalations?	Select the identity collection whose members must not receive escalated approval requests. This field appears only when escalations are enabled for a supported template. Unanswered approval requests escalate up the approver's management chain, stopping one level below the first member of the workflow's escalation ceiling identity collection. If no member is found or no collection is selected, the global ceiling is used. If the global ceiling is also not set or has no members in the chain, escalation goes up one level. See Set the Global Escalation Ceiling. If the collection is reachable in the original task approver's management chain, escalation stops before reaching a member of that collection. If no ceiling is selected, escalation stops one management level above the original task approver. The same limit applies when no manager in that chain belongs to the selected collection. The request doesn't escalate further. For example, select the Board of Members identity collection to exclude its members from escalated campaign approval tasks.
Should the approval request have an expiration time?	Click Yes or No.
How should we handle pending approvals after the approval request expires	If an approval request has an expiration time, select one of the following to close the pending tasks: Approve all Reject all
How many days until the approval request expires?	Configure how many days an approval request remains active before it expires.
Do you want to auto-approve access requests without an Access Guardrail or SOD violation?	Click Yes to automatically approve access requests when no Access Guardrail or SOD violations are detected. This setting doesn't automatically approve requests with violations.
Do you want auto-approval performed on access requests with Access Guardrail or SOD violations?	Click Yes to enable automatic approval of access requests with Access Guardrail or SOD violations. Other automatic approval criteria, including the workflow's self-approval setting, still apply. See Auto-Approval Matrices and Criteria.
Which identity collection should we use to auto-approve access requests based on the requestor's affiliation?	Select the identity collection whose membership is used to evaluate automatic approval based on the requestor's affiliation. The requestor's membership is considered together with the workflow's violation and self-approval settings. See Auto-Approval Matrices and Criteria.
Should the workflow continue when the approval result is rejected?	Click Yes or No to specify whether the workflow continues after a rejection. For example, you can continue gathering Management Chain approvals after the beneficiary's manager rejects the request.

Add Details

With the Add details step, you can add a name to the approval workflow and give a short description of the workflow.

To add details:

Enter the name of the workflow in the What do you want to call this approval workflow? field.
Enter a short description of the workflow in the How do you want to describe this approval workflow? field.
On entering the details, Click Next to go to the Review and submit step.
Optionally, you can select:
- Save Draft: To save your changes and later come back and edit the workflow or details
- Cancel: To cancel the current process.
- Back: To go back to the previous step.

Add Owners

Add primary and additional owners to your orchestrated system so they can manage resources.

You can associate resource ownership by adding primary and additional owners. This drives self-service as these owners can then manage (read, update or delete) the resources that they own. By default, the resource creator is designated as the resource owner. You can assign one primary owner and up to 20 additional owners for the resources.

Note

When setting up the first Orchestrated System for your service instance, you can assign owners only after you enable the identities from the Manage Identities section.

To add owners:

Select an Oracle Access Governance active user as the primary owner in the Who is the primary owner? field.
Select one or more additional owners in the Who else owns it? list. You can add up to 20 additional owners for the resource.

You can view the Primary Owner in the list. All the owners can view and manage the resources that they own.

Review and Submit

The Review and submit step displays the information you have added in the previous steps. In this screen, you can select:

Publish: To publish the workflow
Save Draft: To save your changes and later come back and edit the workflow or details
Cancel: To cancel the current process
Back: To go back to the previous step

Oracle Cloud Infrastructure Documentation