Approval Workflow¶

Have connections to sensitive resources approved with the approval workflow: the user submits a request, an approver handles it, then the user connects. An approver is a user, or a member of a group, designated on a resource to accept or reject connection requests.

The workflow is enabled resource by resource, as soon as it has at least one approver. Organization administrators and members of an exempted group bypass it and connect directly; instance administrators do not.

Depending on your role:

You administer the organization: follow the steps below.
You approve requests: see My Approvals.
You want to connect to a resource: see Request Access to a Resource.

Set Up the Workflow¶

Each resource uses the organization’s default rules (Organization default) or overrides them (Custom).

Set the default rules and notifications in Settings > Security.
Assign approvers or approver groups to each relevant resource.
Follow the requests and revoke a request if necessary.

Tip

Connection forms are independent of approval: you can ask users to justify their connection, with or without approval.

The instance administrator sets the default notifications for all organizations (see instance configuration); step 1 lets you adjust them for yours.

Default Settings and Per-Resource Settings¶

The approval workflow is enabled resource by resource, by assigning approvers. The duration rules have a value at the organization level, which each resource can replace by choosing Custom; notifications are only set at the organization level.

Setting	Organization	Resource
Request expiration	Default value	Can override
Time to connect once approved	Default value	Can override
Maximum session duration	Default value	Can override
Reconnection grace period	Default value	Can override
Approvers, approver groups and required approvals	No	Yes
Exempted groups and No approval during	No	Yes
Notifications (email, webhook, reminder)	Yes	No

The organization is set in Settings > Security (see Approval Workflow), the resource in its Approvers tab (see Configure Approval for a Resource).

Flow of a Request¶

1. Request

send

The user submits an access request.

Request Access to a Resource

2. Notify

notifications

Approvers are notified.

Notifications

3. Decide

approval

One or more approvers approve or reject it.

My Approvals

4. Connect

cast_connected

If approved, the user connects.

The user can ask for an extension when the session is time-limited.

Request Statuses¶

Follow a request’s status in the filters of Access Requests and My Approvals. A scheduled request (badge For) or an extension (badge Extension) follows the same flow. The Refused, Canceled, Expired and Revoked statuses close the request.

Status	Meaning	Next
Pending	The request is waiting for the required approvals.	A single rejection sets it to Refused; once the required number of approvals is reached, it becomes Approved.
Approved	The request is granted, the connection has not happened yet.	The user connects (Used); an approver or an administrator can revoke it.
Used	The connection has happened.	It can still be revoked: the session is then cut.
Refused	An approver rejected the request.	—
Canceled	The user canceled their request.	—
Expired	The request was not handled, or not used, within the time limit.	—
Revoked	An approver or an administrator withdrew the access.	The session is cut, and the user can no longer reconnect with this request.

Who Can Do What¶

Set the default rules and notifications: organization or instance administrator.
Assign approvers, exemptions and a form to a resource: organization administrator.
See all of the organization’s requests: organization or instance administrator.
Approve or reject a request: approver assigned to the resource, individually or through a group.
Revoke an approved or used request: organization administrator (any request), group administrator (requests of their groups) or the resource’s approver.
Request access, schedule a connection, extend a session: standard user or instance administrator.
Connect without a request: organization administrator, or member of an exempted group.