Skip to content

Approval Workflows

Jump to bottom
NeySlim edited this page May 2, 2026 · 3 revisions

Approval Workflows

UCM includes an approval workflow system that requires designated approvers to review and approve certificate operations before they are executed. This adds a governance layer to your PKI, ensuring that certificate issuance, renewal, and revocation follow organizational policies.

Overview

When approval policies are configured, certain certificate operations are held in a pending state until approved by a user with the appropriate permissions. This is critical for organizations that require multi-person authorization for PKI changes.

How It Works

  1. Admin creates a policy defining which operations require approval and for which CAs
  2. User requests an operation (e.g., issue a certificate) — the request enters "pending" state
  3. Approver reviews the request — can approve or deny with comments
  4. On approval — the operation executes automatically
  5. On denial — the requester is notified with the denial reason

Policies

Navigate to Governance → Policies to manage approval policies.

Policy Settings

Setting Description
Name Policy name for identification
Description Explanation of what the policy covers
Actions Which operations require approval (issue, revoke, renew, delete)
CAs Which Certificate Authorities this policy applies to
Templates Optionally restrict to specific certificate templates
Enabled Toggle the policy on/off without deleting it

Creating a Policy

  1. Go to Governance → Policies
  2. Click Create Policy
  3. Fill in the name, description, and select applicable actions
  4. Choose which CAs the policy covers
  5. Optionally restrict to specific templates
  6. Click Create

Policy Scope

Policies can be scoped to:

  • All CAs — applies globally
  • Specific CAs — only certificates issued by selected CAs
  • Template-based — only certificates using specific templates
  • Action-based — only certain operations (issue, revoke, etc.)

Approval Requests

Navigate to Governance → Approvals to view and manage pending requests.

Request States

State Description
Pending Waiting for approver review
Approved Approved and executed
Denied Rejected by approver
Expired Not reviewed within the timeout period
Cancelled Withdrawn by the requester

Reviewing a Request

  1. Go to Governance → Approvals
  2. Click on a pending request to see details
  3. Review the requested operation, parameters, and requester
  4. Click Approve or Deny
  5. Add optional comments explaining the decision

Approval Permissions

  • Users with write:approvals permission can approve/deny requests
  • The requester cannot approve their own request (enforced by the system)
  • Admins can approve any request

Race-safe quorum (since v2.142)

Concurrent approvals on the same request are serialised with a per-request DB lock and the quorum is recounted inside the transaction before the request is marked approved. Two simultaneous approvals can no longer both observe quorum - 1 and double-trip the request to approved state.

Re-submitting an approval from the same user is idempotent — it is not double-counted and does not return 409. The UI's "Approve" button is therefore safe to click twice.

RBAC Integration

Approval workflows integrate with UCM's Role-Based Access Control:

Role Can Request Can Approve
Admin ✅ ✅ (any request)
Operator ✅ ✅ (if has write:approvals)
Viewer ❌ ❌

Audit Trail

All approval actions are logged in the audit system:

  • Request creation (who, what, when)
  • Approval/denial (who, decision, comments)
  • Execution result (success/failure)

View approval history in Admin → Audit Logs with the "approvals" category filter.

API Endpoints

GET /api/v2/approvals

List approval requests. Supports filtering by status.

Permission: read:approvals

POST /api/v2/approvals/{id}/approve

Approve a pending request.

Permission: write:approvals

POST /api/v2/approvals/{id}/deny

Deny a pending request with a reason.

Permission: write:approvals

GET /api/v2/policies

List all approval policies.

Permission: read:policies

POST /api/v2/policies

Create a new approval policy.

Permission: write:policies

Best Practices

  1. Separation of duties — Ensure requesters and approvers are different people
  2. Minimal scope — Apply policies to specific CAs rather than globally when possible
  3. Document policies — Use clear descriptions so approvers understand what to check
  4. Review regularly — Periodically audit active policies and pending requests
  5. Template-based policies — Use templates to standardize what gets approved

See Also

Clone this wiki locally