Delegation Approvals & Logic

​

Overview

In Aptly, delegations may require approval before they become active. Whether an approval is triggered depends on:

• The Decision configuration (approval required: yes/no)
• The Delegation context (who is delegating, to whom, and with what limits)
• System-wide or group-based settings that enforce review workflows

This page outlines how approval decisions are made and how approvers are assigned.

​

✅ When Is Approval Required?

Approval is required when any of the following apply:

• The Decision explicitly requires approval before delegation
• The user is delegating beyond their own limits (if configured)
• System settings or group-specific rules require oversight for certain decisions

If none of these apply, the delegation may be automatically marked as Issued.

Approval is always required for Root Delegations if the Decision demands it.

​

⚙️ How Approval Actions Work

When Aptly determines that a delegation needs approval, it automatically creates a Delegation Approval Action.

Each Approval Action is:

• Linked to a specific delegation
• Timestamped and tracked through an auditable lifecycle
• Assigned to one or more eligible approvers

While the approval is pending, the delegation remains in Pending status and cannot be cascaded further.

​

👥 How Are Approvers Assigned?

Approvers are selected based on role and scope:

1. Aptly finds users with the can_approve_delegation permission
2. It evaluates each user’s scope:
   • All — Can approve across the tenant
   • Groups — Can approve delegations tied to specific groups they manage
3. From the valid pool, one approver is selected (by default via round-robin, but this is configurable)

Approvers don’t need to be in the same department or reporting line as the issuer. Scope and permission are the only requirements.

​

🔄 Approval Flow

Here’s how a delegation flows through approval:

1. A user creates a delegation
2. Aptly evaluates whether approval is required
3. If required, it generates an Approval Action
4. An eligible approver is assigned
5. Approver reviews and either approves or rejects
6. Delegation status is updated to Issued or Denied
7. Audit logs capture the full trail

Delegations that are denied can be revised and resubmitted (based on system settings).

​

🔒 Permissions Involved

Users without the proper scope will not be considered eligible approvers.

​

📘 Related Pages

• Delegation Lifecycle →
• Roles & Permissions →
• System Settings →