Access requests and approval

Many organizations need to give users access to systems, groups, roles and resources without losing control over who approved what. Access requests and approvals make access decisions more structured, traceable and possible to follow up.

Use case

In many organizations, access is requested through email, service desk tickets or informal processes. This makes it difficult to ensure that the right people review access, that justifications are documented and that decisions can be followed up afterward.

The business needs to manage access in a way that follows organizational rules and responsibilities. This can include ensuring that:

• access is granted only when there is a clear business need
• the right manager, resource owner or responsible person is involved in the decision
• justification, decision and completed change are documented
• sensitive entitlements receive additional review
• decisions can be followed up during audits, internal control or troubleshooting

The result is a clearer process where users can request access, responsible people can make decisions and the organization can show why access exists.

How Fortified ID supports this

Fortified ID Control can be used to create structured request and approval flows. Forms can give users a controlled way to request access to applications, groups, roles or other resources. Approval Flows can control who should review and approve the request based on business rules and responsibility relationships.

Fortified ID Control can also be used as an executor in a larger flow where request and approval are handled in another system, such as ServiceNow or another ITSM platform. In those scenarios, Control can receive the decision, perform the change in the affected systems and contribute traceability around what was executed.

Business Rules can apply additional controls, for example for sensitive entitlements or specific user types. Reporting and Auditing can provide evidence for following up requests, approvals and completed changes.

Fortified ID Access can complement the flow when access decisions require stronger identity verification. Strong authentication or step-up authentication can be used when requesting or approving sensitive entitlements.

Examples

• Requesting access to applications and business systems
• Applying for membership in groups or roles
• Approval of access by a manager, resource owner or other responsible person
• Extra control for sensitive or business-critical entitlements
• Requesting access for consultants, partners or other external users
• Executing entitlement changes where request and approval are handled in another system
• Following up who requested, approved and granted access