How to manage user roles and approval permissions in Approvals

Step by step

1. 1

   1. Understand the Role Hierarchy in Approvals (IAM Member.role)

   Approvals uses roles defined in IAM membership to determine what actions each user can perform: - Administrator (admin): Full control. Manages users and roles in /iam-admin, creates and edits rules/matrices in /approval-rules, views all requests in /aprobador, and can approve, reject, escalate, and cancel requests at any step. Also manages own and third-party delegations. - Supervisor (supervisor): Same operational scope as Admin within Approvals (isApprovalAdmin = true). Can approve, reject, escalate, and cancel requests, as well as configure /approval-rules. Does not have access to /iam-admin (global IAM user management). - Approver (approver): Only views and manages requests for their assigned step or direct assignment. Can approve, reject, escalate, and skip requests. CANNOT cancel requests (403 Forbidden). Only manages their own delegations. - Reviewer / Auditor (reviewer): Read-only profile (READ-ONLY). Can inspect approval requests and workflow status for compliance and auditing, but cannot perform any operational actions.

2. 2

   2. Access the User Management Panel (/iam-admin)

   To manage users and their roles: 1. Log in to TheEye platform with an account having Admin or Root role. 2. In the left sidebar, click on 'Administration' (shield/crown icon), which routes to /iam-admin. 3. The main table lists all members and users registered in the company/project.

3. 3

   3. Assign or Modify a User Role

   Once inside /iam-admin: 1. Locate the user in the table and click on their row to open the editing sidebar (app-iam-admin-user-edit). 2. In the panel, find the 'Role' dropdown and select the appropriate level for the project: admin, supervisor, or approver. 3. If the user requires global administrative privileges across the organization, toggle the 'Company Admin' switch. 4. Save the changes to apply new permissions immediately.

4. 4

   4. Manage Cancellation Permissions and Critical Actions

   Please note that the ability to cancel requests is not a separately configurable toggle. In Approvals, this action is tied to the internal condition isApprovalAdmin, granted only to Admin, Supervisor, and Root roles. If a regular approver attempts to force a cancellation, the API returns a 403 Forbidden error. Ensure the Supervisor role is granted only to staff authorized to abort approval workflows.

5. 5

   5. Configure Approval Delegation and Responsibility Transfers (/delegaciones)

   When an approver is temporarily absent or needs to hand over responsibilities: 1. Go to the /delegaciones section in the Approvals menu. 2. Create a new delegation by selecting the substitute user along with the start and end date/time. 3. During the specified period, the substitute will automatically be authorized to approve or reject requests routed to the primary approver. 4. Administrative note: While an 'approver' can only create personal delegations, users with 'admin' or 'supervisor' roles can create delegations on behalf of any user (on behalf of), ensuring business continuity without requiring intervention from the absent user.