Approval licensing

[Community Alums]

Hi,

Found an issue which questions approval licensing. Steps to reproduce:

1. Create a flow which triggers an approval to any user.

2. Ensure the approver doesn't have any roles or groups.

3. I am sending approval link in email notification.

4. Impersonate/login with approver & open the approval link sent in notification.

5. Try to approve the request using approve UI action.

Issue/question:

- With OOTB configuration the approver is still able to see UI action & approve the request also. What is the use of "approver_user" role if approvers can approve even without the role? 

- We have raised a ticket with ServiceNow & they said they don't see this as a defect and have asked us to modify OOTB UI action to restrict approvers from approving. I can just go with the OOTB configuration & save the approval licensing cost?

Any inputs/suggestions?

Thanks!

[Mark Manders]

It looks like you indeed have the ability to approve if you are the approver, no matter the role (or lack of roles). You could take the gamble of keeping the OOTB config active and remove the approver role(s) from the users, but I think ServiceNow will come calling about this.

Approvals have been handled in a lot of different ways by different customers I have been working with/for, to save those costs, but this is a new one. They hide the menu option if you don't have the role, but you are able to see the record and do actions on them.

The risk you run: get rid of the cost and don't buy any approval licenses, ServiceNow changes the code themselves in any future patch/upgrade and you won't be able to approve any more, or need to buy licenses very fast.

[Francis L_]

I think there is a legit way to approve and delegate without any role as explained in those KB article edited by Servicenow:

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0719074

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0960709

If my answer helped you in any way, please then mark it as helpful or correct.

[Mark Manders]

This is about approving via email and making the approval module available for other roles. Did you also check if making the module available for other users, gave them permission to approve?

[Francis L_]

Any user without role can approve with the 2 articles linked in previous post,

and this is what we have in place.

A user without role cannot see the record(RITM, change etc...), only the approval request, and can interact with button (UI action) to accept or reject. You can also configured your approval request to copy information from ''approval for'' field to your request approval, in order to give basic information to approver who can only read approval request