Data and Business Systems
Design approval workflows with delegation and exceptions
Approval routes break when the named approver is absent or a request changes mid-review. Design delegation, escalation, revised submissions, and exceptional authority as explicit business rules rather than informal workarounds outside the application.
A simple approve button hides several decisions. Is the approver authorized for this record? What happens during absence? Does approval still apply after the request changes? A usable workflow answers these questions before the first exception. Model approval as a controlled business action, not just movement between two status labels.
Bind approval to a defined request
Identify the content an approval covers and the conditions that require another review. A changed destination may matter more than a corrected spelling. Recommend keeping an approved revision separate from a later proposal so operators do not mistake old approval for authorization of new content.
Show the reviewer enough context to decide, including relevant attachments and unresolved checks. Separate review, approval, and execution if they represent different responsibilities. A person able to comment on a request should not automatically gain authority to approve it or carry out the resulting action.
Make delegation narrower than identity sharing
A delegate acts with explicit scope, duration, and business conditions. The original approver should not share an account. OWASP recommends validating permissions on every request.[4] Check the delegate at the moment of the decision, including whether the delegation remains valid for the record and action.
Record the acting person and the delegation used. OWASP logging guidance emphasizes who performed an event and what occurred.[3] Add the original authority as business context, rather than replacing the actual actor with the absent manager. Make revocation visible to pending work.
Hypothetical example: an urgent access request
A hypothetical warehouse team needs approval to grant temporary access to a restricted storage area. The usual supervisor is absent. A named delegate can approve only requests for that site during the agreed absence window. Requests outside the site go to a separate exception owner.
The requester then extends the requested access duration. The proposal returns for review because the earlier approval covered a narrower interval. This adds friction to an urgent task, but it preserves a clear explanation of who accepted the actual scope. No automatic approval is implied.
Provide an exception route without losing control
Escalation should assign responsibility, not silently approve when a timer expires. Decide how reminders, reassignment, rejection, and withdrawal interact. Distinguish a request waiting for review from one blocked because no eligible approver exists. Both need attention, but their remedies differ.
A highly detailed approval model costs more to maintain and can slow routine work. Start with the smallest rule set that represents real authority. Test absent approvers, changed requests, expired delegations, and competing decisions before expanding the route to every department. Show the requester where the item waits and which owner can resolve a blocked route.
- List approval scope and triggers for renewed review.
- Limit delegation by action, records, and duration.
- Record the actual actor and delegated authority.
- Assign an owner for requests with no eligible approver.
- Test concurrent decisions and withdrawn requests.
