Create Approval Workflow

Oracle Access Governance users with the Access Control Administrator or Administrator application role can create approval workflows from the Oracle Access Governance Console. Every permission or role that needs to be assigned to a user must be processed through an approval workflow. As a resource administrator, you must design the workflow by specifying the required approval level and the number of approvers. Later, as a permissions manager, you can use these workflows to obtain approvals before assigning or revoking user privileges

For example, when a user requests access to an access bundle via a self-service system, the approval workflow associated with that request triggers a notification via email to the approvers, who then review the request and approve it, reject it, or can request for more information. The result of the approval process is updated in the permissions management system.

Note:

The approver/manager can also log into the self-service system and review the pending approvals.

Navigate to Approval Workflow

  1. Sign in to the Oracle Access Governance Console with a user assigned with Service Administrator role.
  2. Click the Navigation icon and select Access Controls, and then Approval Workflows. You will be navigated to the Approval Workflows screen, where you can view and manage the existing workflows.
  3. Click the Create approval workflow button.

    You will be navigated to the Create a new approval workflow screen, from which you can create and configure approval workflow.

Create Approval Workflow

  1. In the Create a new approval workflow page, click the Plus Icon icon.
    You will be navigated to the Add a new approver step.

    Note:

    You can add only one type of approver at a time.

Build Approvals

  1. Select the type of approval from the Which type of approval? dropdown list.
    The available values are:
    • Benificiary
    • Beneficiary's Manager
    • Custom User
    • Identity Collection
    • Management Chain
    • Owner

    Note:

    The other options on the page change depending on the type of approval selected. We have selected the approval type as Management Chain for this workflow as an example.
  2. Enter the following details in the Add a new approval pop-up window and then click Add.
    Field Description
    Management Chain Ceiling Select levels up in the management chain to be involved in the approval process.
    Advanced settings
    How many hours between notifications? Enter the number of hours within which a reminder must be sent to the approver.
    How many hours to wait before escalating the approval request? Enter the number of hours to wait prior to escalating an approval request.
    Which identity collection should be excluded from escalations? Select the identity collection that should be excluded from the escalations.

    Note:

    The group selected here will not receive any approval requests triggered by an escalation.
    Should the approval request have an expiration time? Add time after which the approval request will expire. Default is No.
    Should the workflow continue when the approval result is rejection. If No then, if any level of the workflow returns a rejection result, the workflow ends. If Yes then the workflow continues.

    The entered details will be displayed on the Create a new approval workflow screen.

  3. In the Create a new approval workflow screen, click:
    • Add parallel: To add a parallel approver. This adds an approver that will be requested at the same time as the currently selected approver.
    • Add next: To add a next level of approver. This adds an approver that will be requested after the current approver completes.

Add Parallel Approver

  1. In the Create a new approval workflow screen, click the Add parallel button.
  2. Enter the following details on the screen, and then click Add button.
    Field Description
    Which type of approval? Select the type of approval.

    Note:

    In this workflow, we have selected the type of approval as Management Chain.
    Management Chain Ceiling Select number of levels up in the management chain to be involved in the approval process.
    How many levels up in the management chain should the approval go? Select the level that should be involved in the approval process.

    Note:

    This field name changes based on the type of management chain ceiling selected.
    Advanced settings
    How many hours between notifications? Enter the number of hours within which a reminder must be sent to the approver.
    How many hours to wait before escalating the approval request? Enter the number of hours to wait prior to escalating an approval request.
    Which identity collection should be excluded from escalations? Select the identity collection that should be excluded from the escalations.

    Note:

    The group selected here will not receive any approval requests triggered by an escalation.
    Should the approval request have an expiration time? Add time after which the approval request will expire. Default is No.
    Should the workflow continue when the approval result is rejection. If No then, if any level of the workflow returns a rejection result, the workflow ends. If Yes then the workflow continues.
After adding a parallel approver, in the Create a new approval workflow screen, click:
  • All: If you want all the approvers to approve the request
  • Any: If you want any of the approvers to approve the request

Add Next Level of Approver

  1. In the Create a new approval workflow screen, click the Add next button.
  2. Enter the following details on the screen, and then click Add button.
    Field Description
    Which type of approval? Select the type of approval.

    Note:

    In this workflow, we have selected the type of approval as Management Chain.
    Management Chain Ceiling Select number of levels up in the management chain to be involved in the approval process.
    How many levels up in the management chain should the approval go? Select the level that should be involved in the approval process.

    Note:

    This field name changes based on the type of management chain ceiling selected.
    Advanced settings
    How many hours between notifications? Enter the number of hours within which a reminder must be sent to the approver.
    How many hours to wait before escalating the approval request? Enter the number of hours to wait prior to escalating an approval request.
    Which identity group should be excluded from escalations? Select the identity group that should be excluded from the escalations.

    Note:

    The group selected here will not receive any approval requests triggered by an escalation.
    Should the approval request have an expiration time? Add time after which the approval request will expire. Default is No.
    Should the workflow continue when the approval result is rejection. If No then, if any level of the workflow returns a rejection result, the workflow ends. If Yes then the workflow continues.

Add Details

With the Add details step, you can add a name to the approval workflow and give a short description of the workflow.

To add details:
  1. Enter the name of the workflow in the What do you want to call this approval workflow? field.
  2. Enter a short description of the workflow in the How do you want to describe this approval workflow? field.
  3. On entering the details, click Next to go to the Review and submit step.
  4. Optionally, you can click:
    • Save Draft: To save your changes and later come back and edit the workflow or details
    • Cancel: To cancel the current process.
    • Back: To go back to the previous step.

Add Primary and Additional Owners

You can associate resource ownership by adding primary and additional owners. This drives self-service as these owners can then manage (read, update or delete) the resources that they own. By default, the resource creator is designated as the resource owner. You can assign one primary owner and up to 20 additional owners for the resources.

No special application roles are necessary for assigning resource ownership. Any Oracle Access Governance active user can be assigned as the owner of the resources. All the owners can read, update, or delete the resources that they own. However, the Primary Owner is assigned as the access reviewer when you choose the Owner template in the approval workflow for performing Ownership reviews in Campaigns. For more information, refer Types of Access Reviews Offered by Oracle Access Governance.
For assigning resource ownership, you must have active Oracle Access Governance users. When setting up the first Orchestrated System for your service instance, you can assign owners only after you enable the identities from the Manage Identities section.
  1. Select an Oracle Access Governance active user as the primary owner in the Who is the primary owner? field.
  2. Select one or more additional owners in the Who else owns it? list. You can add up to 20 additional owners for the resource.
    You can view the Primary Owner in the list. All the owners can view and manage the resources that they own.

Review and Submit

The Review and submit step displays the information you have added in the previous steps. In this screen, you can click:
  • Publish: To publish the workflow
  • Save Draft: To save your changes and later come back and edit the workflow or details
  • Cancel: To cancel the current process
  • Back: To go back to the previous step