Self-Service Access Requests & Approval Routing

Requesting temporary or permanent role access, managerial signoff chains, authority validation, and automated provisioning.

SmartERP 19 enforces structured self-service provisioning through smarterp.rbac.request, preventing unapproved privilege escalation.

Approvals Request Center

Request Lifecycle & State Machine#

 [Draft] ---> [Submitted] ---> [Manager Endorsement] ---> [Security Lead Review] ---> [Provisioned]
                  |                     |                         |
                  v                     v                         v
              [Cancelled]           [Rejected]                [Rejected]

Access Request Fields Reference#

Field Technical Name	Type	Description
`user_id`	Many2one (`res.users`)	The employee requesting expanded permissions.
`role_id`	Many2one (`res.users.role`)	Target business role to be provisioned.
`request_type`	Selection	`permanent` (indefinite) or `temporary` (time-bound).
`date_start` / `date_end`	Date	Validity period for temporary access.
`justification`	Text	Business explanation (mandatory, min. 20 chars).
`sod_check_result`	Selection	Automated SoD check: `clean`, `warning`, or `blocked`.

Step-by-Step: Requesting Elevated Access#

The employee navigates to Approvals -> Access Requests -> New.
Select the required role and duration.
Provide the detailed business justification.
Click Submit.
SmartERP runs an automated Segregation of Duties (SoD) evaluation:
- If a blocking conflict is detected, submission is prevented.
- If clean, an approval activity routes to the user's direct manager.
Upon final security officer approval, the role is activated and logged to the audit trail.

መጨረሻ የተሻሻለው: 2026-10-16