> For the complete documentation index, see [llms.txt](https://docs.adaptiva.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.adaptiva.com/patch/advanced-settings/chains/chains-approval.md).

# Approval Chains

How to use and create Approval Chains within OneSite Patch.

## Get Started with Approval Chains

Approval Chains enable administrators to specify users who will receive patch approval requests for specific Patching Strategies or Business Units.

OneSite Patch includes suggested Approval Chain personas, such as Product Owner, Patch Management, Security, Test Lab, and Change Management. You can customize and layer these roles to model the natural approval structure in your environment, including backup approvers and timeout settings to allow for automatic escalation. You can also omit layers based on patch criticality/urgency.

If you have not yet assigned team members to these roles, see [Role-based Access Control (RBAC) in OneSite Patch](/patch/security-and-access-control/patch-rbac.md).

## Create an Approval Chain

1. Select **Advanced Settings > Intent Schema > Chains > Approval Chains** from the side navigation.
2. Click **+ New.**

   ![All Approval Chains dialog](https://2503798551-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7VJNM00p5XQ4pMWqCu8y%2Fuploads%2Fgit-blob-08371a0a27f88e6d701ea3c2d74d832da4baa31e%2Fapproval-chains.png?alt=media)
3. For **Name**, give your Approval Chain a meaningful name. Use the **Description** box if you have additional text to add.
4. Next to **Communication Providers**, click **+ Browse** and select the technology you'll use to contact your approvers.

   ![All Communication Providers dialog](https://2503798551-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7VJNM00p5XQ4pMWqCu8y%2Fuploads%2Fgit-blob-774ce9414f573365778575972a4f93305d3fef3f%2Fall-communication-providers.png?alt=media)

Depending on what you want to do with your Approval Chain, see the various scenarios outlined below under **Configure Chain Behavior**.

## Configure Chain Behavior

Approval Chain management choices include approval of timed out patches, re-approval of modified approvals, setting approval layers, and choosing communication providers.

![](https://2503798551-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7VJNM00p5XQ4pMWqCu8y%2Fuploads%2Fgit-blob-8168d23f26e5951f66dbc9f603a70f9cacc8316d%2Fimage3.png?alt=media)

### Set Timeouts with Automatic Approvals

When enabled, the **Automatically Approve Timed Out Patches** toggle automatically approves patches when reviewers do not respond within the timeout duration specified in the **Approval Layers**.

![](https://2503798551-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7VJNM00p5XQ4pMWqCu8y%2Fuploads%2Fgit-blob-ede85c01be659173aba35b10459bfb940c27d82b%2Fimage4.png?alt=media)

### Require Re-approval after Changes

When enabled, the **Reapprove Modified Approvals** toggle resends an approval request to earlier approvers if a later approver makes any modifications to the patch or process.

![](https://2503798551-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7VJNM00p5XQ4pMWqCu8y%2Fuploads%2Fgit-blob-49f06cc585d5c8751c32ac154a05caa84ac7a02a%2Fimage5.png?alt=media)

### Create an Approval Layer

Any object that uses this Approval Chain will process approvals top to bottom in the order listed in the approval layers.

1. Scroll down to **Approval Layers** in an Approval Chain template.

   * For a new approval Layer, click **+ Create Approval Layer**.
   * To change an existing Approval Layer, click the **ellipsis (...)** to the right of the Approval Layer name for the role you want to change, and then click **Edit Approval Layer**.

   ![](https://2503798551-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7VJNM00p5XQ4pMWqCu8y%2Fuploads%2Fgit-blob-36732964e5086e8cc9aade071be1adba1a37799e%2Fimage6.png?alt=media)
2. This opens the **Edit Approval Layer** dialog.

#### Assign Roles and Decide the Order of Approvers

The processing order sends approvals from the top to bottom based on the order of the listed roles.

1. From the **Edit Approval Layer** screen, click **+ Browse** to see a list of possible approval roles.
2. Select one or more existing **Names** from the **All Roles** table, and then click **OK**.
3. Reorder the roles to reflect the processing order you want the strategy to use:

   a. Select and hold the **stacked dots** for the role you want to move.

   b. Drag the **role** up or down to move it in the list.

#### Add Roles to an Approval Layer

OneSite Patch includes templates for commonly required roles. You can add these existing roles to the Chains you create by creating approval layers.

1. Click **+ Create Approval Layer** in an open **Approval Chain** template. This opens the **Create Approval Layer** dialog.
2. Next to **Approver Roles**, click **+ Browse**.
3. If you are in a filtered view, click **Show All** on the upper-right to view the available Roles.
4. Select one or more **Roles**, and then click **OK**.

#### Set Approval Thresholds (Unanimous vs Count)

Choose the number of approvers who must approve patches to satisfy this Approval Layer:

* To enable unanimous approval, use the toggle for **Unanimous Approval Needed** and flip it to the on position. All approvers must approve before deployment continues. Defaults to disabled.
* If you leave the toggle in the disabled position, then you must enter the **Number of Approvals Needed**.

#### Designate Backup Approvers

Select backup roles for this approval chain layer. Backup roles are only called if the initial approver roles timeout (based on the **Approval Timeouts** field). If backup roles do not approve within the approval timeout duration, the approval request fails.

1. Next to **Backup Roles**, click **+ Browse**.
2. If you are in a filtered view, click **Show All** on the upper-right to view the available Roles.
3. Select one or more **Roles**, and then click **OK**.

#### Automate Reminders

These settings define when to send approval reminders to approvers who have not responded. You can specify different reminder intervals for each urgency level. A setting of 0 sends no reminders.

1. Next to **Reminder Intervals**, click **Manage Reminder Intervals**.
2. Enter a number for the **Urgency Reminder Interval** (**Low**, **Normal**, **High**, **Critical**).
   * At 0, the strategy sends no reminder.
   * When the request times out, the approval request fails.
3. Click **OK**.

#### Manage Expiration Timeouts

These settings specify the amount of time after which an approval request will time out. If backup roles have been specified, the request will be sent to the backup approvers, else the approval request will fail. You can specify different reminder intervals for each urgency level. A setting of 0 sends no reminders.

1. Next to **Approval Timeouts**, click **Manage Approval Timeouts**.
2. Enter a number for the **Urgency Approval Timeout Duration** (**Low**, **Normal**, **High**, **Critical**).
   * At 0, the strategy sends no reminder.
   * If the request times out, the approval request fails.
3. Click **OK**.
4. Click **Create Approval Layer**, and then click **Save**.

### Add Communication Providers

Adaptiva supplies default Communication Providers that you can use here, or you can create your own. To create new Communication Providers that you can choose when creating Chains, see [Communication Providers](/patch/advanced-settings/communication-providers.md).

1. Next to **Communication Providers**, click **+ Browse**.
2. Select one or more providers to add to the Approval Chain.
3. Click **OK**, and then click **Save**.

## Apply Chains to Your Environment

Patching Strategy and Business Unit object templates include an **Approval Chains** dialog so you can define administrative approval details as part of the object.

Use this procedure to assign existing **Approval Chains** to a Patching Strategy or Business Unit template. This procedure assumes you have opened and saved an object template and are ready to configure the Approval Chains.

### Link Approval Chains to a Patching Strategy

{% hint style="info" %}
Basic Strategies create read-only Approval Chains when you add transitions. You only need to explicitly link an Approval Chain when you are using Advanced Strategies.
{% endhint %}

1. From within the **Strategies** editing area, select **Approval Chains** to open the **Approval Chains** workspace.
2. Click **Browse** next to the type of Approval chain you want to add (Product Owner, Patch Management, Security, and so on).

   ![](https://2503798551-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7VJNM00p5XQ4pMWqCu8y%2Fuploads%2Fgit-blob-84110a6c61379e78c93827395218f0297c8120f5%2Fimage18.png?alt=media)
3. Select an **Approval Chain** from the **Approval Chains** table.

   ![](https://2503798551-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7VJNM00p5XQ4pMWqCu8y%2Fuploads%2Fgit-blob-ee7999f482a4bf6ae159ae919b8464149a2ae566%2Fimage19.png?alt=media)
4. Click **OK** to return to the object template.
5. Repeat Steps 2 through 4 for each of the groups listed in the **Approval Chains** workspace:
   * Skip any groups that do not apply to your situation.
   * When each group from which you need an approval contains an approval chain, continue with the next step.
6. Click **Save** at the upper-left to save your progress:

   a. Check the **Error View** and resolve any errors.

   b. Click **Save** again if you make any changes.

### Link Approval Chains to a Business Unit

Adding Approval Chains to a Business Unit is an advanced feature. The **Approval Chains** fields allow advanced users to specify details for use in customized Patching Strategies, Deployment Chains, or Business Units when necessary to achieve different results.

1. In an open **Business Unit** template, click **Approval Chains**. This opens the **Approval Chains** workspace.
   * Business Units inherit these settings from a parent by default. For more information about inheritance, see [Parent and Child Business Units](/patch/patching-fundamentals/business-units.md#parent-and-child-business-units)

     ![](https://2503798551-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7VJNM00p5XQ4pMWqCu8y%2Fuploads%2Fgit-blob-fc7069aff317e292b2b7f2e9463d1bedb7031819%2Fimage20.png?alt=media)
   * Disable inheritance to enable Browse, and then assign a different Approval Chain to a setting.

     ![](https://2503798551-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7VJNM00p5XQ4pMWqCu8y%2Fuploads%2Fgit-blob-8fbfca1056134c0bd166ee997bfa2e3a804d39c5%2Fimage21.png?alt=media)
2. Click **Browse** or something like **Add Patch Management Chain** next to the type of Approval chain you want to add (Product Owner, Patch Management, Security, and so on).
3. Select an **Approval Chain** from the **Approval Chains** table. This example uses an **All Admins Approval Chain**.

   ![](https://2503798551-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7VJNM00p5XQ4pMWqCu8y%2Fuploads%2Fgit-blob-d54143b6eb7cb200dbbdfccee770e9f91ec2a61c%2Fimage22.png?alt=media)
4. Click **OK** on the lower-left to return to the **Approval Chains** workspace.
5. Repeat Steps 2 through 4 for each of the groups listed in the **Approval Chains** workspace:
   * Skip any groups that do not apply to your situation.
   * When each group from which you need an approval contains an approval chain, continue with the next step.
6. Click **Save**.