Approval workflows | Entitle Pathfinder

Overview

Approval workflows define the Just-in-Time (JIT) permissions approval process in Entitle. When a user requests access, the workflow determines whether approval is required, which conditions apply, who must approve, and how long access is granted. A single workflow can support multiple JIT components, including integrations, resources, roles, and bundles.

How approval workflows work

• Rules and evaluation: Each approval workflow contains one or more rules. Every rule includes:
  • A condition (if) defines when the rule applies.
  • An approval process (then) defines how the request is approved.
    Rules are evaluated in order from top to bottom. The first rule whose condition is met determines the approval process for the request.
• Approval steps: The approval process inside a rule can include multiple steps, each representing an approver or approval action. Steps run sequentially. Each step can use one of two operators:
  • Any: Any approver in the step may approve.
  • All: All approvers in the step must approve.

    ✅

    Avoid assigning specifically named individuals when possible. Use managers, groups, roles, schedules, or other abstract approver types to ensure scalability.

Approver Types

Entitle includes several approver types you can use in workflow steps.

• Team member: Any user who shares the same manager as the requester. For requests made on behalf of another user, this refers to users sharing the manager of the user receiving access. If no direct manager exists, any Entitle admin may approve.
• Resource owner / integration owner: The primary owner of a resource or integration. For bundles, this means the owner of each included resource or integration.
• Resource maintainer / integration maintainer: A secondary administrator of the resource or integration. Multiple maintainers may be assigned, including IdP groups. For bundles, this means the maintainer of each included resource or integration.
• Direct manager: The manager of the user requesting access. For requests made on behalf of another user, this refers to the manager of the user receiving access.
• Automatic Approval: The step is approved automatically, without human intervention.
• Group: Any member of an IdP group at the time of request. Group members cannot approve their own requests. If someone requests access on behalf of another user and belongs to the approval group, the step is automatically approved.
• Schedules: Any member of an on-call schedule. Schedule members cannot approve their own requests. If someone requests access on behalf of another user and is currently on-call, the step is automatically approved.
• Specific user: Any user in the tenant. Start typing to see available users.
• Webhooks: Third-party code that acts as the approver.

  ℹ️

  For more information on webhooks, see Webhook-based approvals.

ℹ️

When using Team or Schedule approvers, only users currently on-call can request access. This design ensures that only active responders can request access.

To allow all schedules (not just on-call users) to request access, create a group containing all schedule members and use that group instead.

View and manage approval workflows

1. Sign in to app.beyondtrust.io with your credentials. The BeyondTrust Pathfinder Home displays.
2. At the top right of the page, select your site from the drop-down.
3. Select the Entitle tile from your list of available applications.
4. From the top left menu, select Approval workflows.

The Approval workflows page lists all existing workflows in your organization, including their name, approval steps, and the total number of roles and bundles associated with each.

This screen has four main functionalities:

1. Edit and delete approval workflows
2. Search, sort, and filter approval workflows
3. Add a new approval workflow
4. Set up webhook-based approvals

Edit and delete approval workflows

1. Edit approval workflow: You can modify the workflow name, access request conditions, and approval steps. you can also add or remove rules and steps, and change rule order using the arrows at the left. After making changes, click Save approval workflow.

   

2. Delete an approval workflow: On the Approval workflows page, locate the workflow you want to remove, then click Delete. Confirm the deletion in the pop-up.

Search, sort, and filter approval workflows

• Search by Workflow name.
• Sort options:
  • Name
  • Number of steps (sorts by the highest step count present in any rule in each workflow)
  • Last added
• Filter options:
  • Name
  • IdP group
  • On-call group
  • Approval by webhook
  • Request duration
  • Usage

Add a new approval workflow

1. On the Approval workflows page, click New approval workflow.
2. Choose a name for your workflow.
3. Define one or more rules, including their conditions and approval steps.
4. Order the rules as needed.
5. Click Save approval workflow.

The newly created approval workflow appears on the Approval workflows main page.

Set up webhook-based approvals

{  
  stageNumber: 1,  
  stageAmount: 3,  
  accessRequest: {  
    behalfOf: {  
      id: "51907709-306b-4587-a89a-4c1a3f8d081f",  
      email: "[[email protected]](mailto:[email protected])",  
    },  
    duration: 15768000,  
    id: "054283fe-f1b4-4bdc-b54e-2adba50f079a",  
    justification: "I need it",  
    number: 114,  
    roles: [  
      {  
        isPrerequisite: false,  
        id: "a7b1e5be-d2bb-4891-a446-406b74ba7b3f",  
        name: "role1",  
        resource: {  
          id: "f40d54f4-1483-431f-bbe1-ce6e19a792eb",  
          name: "resource 1 name",  
          integration: {  
            id: "e5eb6b93-5735-4a65-97fc-5f11e29b9566",  
            name: "manuella",  
            application: {  
              name: "Manual",  
            },  
          },  
        },  
      },  
    ],  
    status: "waitingForApproval",  
    targets: [  
      {  
        type: "role",  
        role: {  
          id: "a7b1e5be-d2bb-4991-a446-406b74ba7b3f",  
          name: "requested role",  
        },  
      },  
    {  
    type: "bundle"
    bundle: {  
      id: "a7b1e5be-d2bb-4991-a446-406b74ba7b3f",  
      name: "requested bundle",  
    },  
  }
]  

{
  "type": "approve" | "decline",
  "token": "token received from webhook data"
}