Any reason not to give everyone approver_user?

[MarkD]

Our licensing allows for unlimited approver_users.

We're running into a situation where anyone in the company could potentially be asked to approve something. 

These users aren't in a preexisting group that we could just add the approver role to.

I'm wondering if we could just give all users the approver_user role so that when they need it,  they'll already have it. 

My understanding is that users can only read and approve requests that are assigned to them anyways...   am I missing anything?

Any downsides to this approach?

[Sandeep Rajput]

@MarkD Although licensing is one of the concerns when it comes to assigning the approver_user role to users. However, it doesn't apply on your case since your subscription allows unlimited approver_users.

Though you can assign this role to all your existing users. However, I still recommend assigning this role via a group and only if the user really need those roles. 

Granting the approver_user role to all users in ServiceNow can have several implications. Here are some considerations to keep in mind:

1. Security Risks: Allowing every user to approve requests can lead to security vulnerabilities. Users may approve requests they don't understand or that should be reviewed by specific individuals, potentially resulting in unauthorized actions or data breaches.

2. Workflow Integrity: Approvals are typically meant to ensure that processes are followed correctly. If everyone can approve, it could undermine the integrity of workflows, leading to chaos and confusion in request handling.

3. Audit Trail Complications: When many users can approve, tracking accountability becomes difficult. In the event of an audit, it may be challenging to determine who approved what and why, which can be problematic for compliance.

4. Increased Approval Volume: If everyone can approve, you may experience an influx of approvals for requests, overwhelming the system and causing delays in processing.

5. Potential for Misuse: Users may approve requests that should be escalated or reviewed further, leading to misuse of the approval system.

6. Role Confusion: Granting this role widely can lead to confusion among users about their responsibilities. Some users might feel empowered to approve requests without understanding the context or implications.

Hope this helps.

[Syaharruddin]

At my company, we manage it by group to align with best practice i.e. roles shouldn't be assigned directly to user but inherited through group.

We have a group called ServiceNow Approver and users are automatically added to it when they have an approval (via business rule). We also automatically remove all group from users when they separate from the company.

We're more diligent since our licensing is still per-user. Your situation is more on maintenance rather than licensing. Ideally all your maintenance should be automated.