Approval Chains

How to use and create Approval Chains within OneSite Patch.

Get Started with Approval Chains

Approval Chains enable administrators to specify users who will receive patch approval requests for specific Patching Strategies or Business Units.

OneSite Patch includes suggested Approval Chain personas, such as Product Owner, Patch Management, Security, Test Lab, and Change Management. You can customize and layer these roles to model the natural approval structure in your environment, including backup approvers and timeout settings to allow for automatic escalation. You can also omit layers based on patch criticality/urgency.

If you have not yet assigned team members to these roles, see Role-based Access Control (RBAC) in OneSite Patch.

Create an Approval Chain

1. Select Advanced Settings > Intent Schema > Chains > Approval Chains from the side navigation.

2. Click + New.

   

   All Approval Chains dialog
3. For Name, give your Approval Chain a meaningful name. Use the Description box if you have additional text to add.

4. Next to Communication Providers, click + Browse and select the technology you'll use to contact your approvers.

   

   All Communication Providers dialog

Depending on what you want to do with your Approval Chain, see the various scenarios outlined below under Configure Chain Behavior.

Configure Chain Behavior

Approval Chain management choices include approval of timed out patches, re-approval of modified approvals, setting approval layers, and choosing communication providers.

Set Timeouts with Automatic Approvals

When enabled, the Automatically Approve Timed Out Patches toggle automatically approves patches when reviewers do not respond within the timeout duration specified in the Approval Layers.

Require Re-approval after Changes

When enabled, the Reapprove Modified Approvals toggle resends an approval request to earlier approvers if a later approver makes any modifications to the patch or process.

Create an Approval Layer

Any object that uses this Approval Chain will process approvals top to bottom in the order listed in the approval layers.

1. Scroll down to Approval Layers in an Approval Chain template.

   • For a new approval Layer, click + Create Approval Layer.

   • To change an existing Approval Layer, click the ellipsis (...) to the right of the Approval Layer name for the role you want to change, and then click Edit Approval Layer.

   
2. This opens the Edit Approval Layer dialog.

Assign Roles and Decide the Order of Approvers

The processing order sends approvals from the top to bottom based on the order of the listed roles.

1. From the Edit Approval Layer screen, click + Browse to see a list of possible approval roles.

2. Select one or more existing Names from the All Roles table, and then click OK.

3. Reorder the roles to reflect the processing order you want the strategy to use:

   a. Select and hold the stacked dots for the role you want to move.

   b. Drag the role up or down to move it in the list.

Add Roles to an Approval Layer

OneSite Patch includes templates for commonly required roles. You can add these existing roles to the Chains you create by creating approval layers.

1. Click + Create Approval Layer in an open Approval Chain template. This opens the Create Approval Layer dialog.

2. Next to Approver Roles, click + Browse.

3. If you are in a filtered view, click Show All on the upper-right to view the available Roles.

4. Select one or more Roles, and then click OK.

Set Approval Thresholds (Unanimous vs Count)

Choose the number of approvers who must approve patches to satisfy this Approval Layer:

• To enable unanimous approval, use the toggle for Unanimous Approval Needed and flip it to the on position. All approvers must approve before deployment continues. Defaults to disabled.

• If you leave the toggle in the disabled position, then you must enter the Number of Approvals Needed.

Designate Backup Approvers

Select backup roles for this approval chain layer. Backup roles are only called if the initial approver roles timeout (based on the Approval Timeouts field). If backup roles do not approve within the approval timeout duration, the approval request fails.

1. Next to Backup Roles, click + Browse.

2. If you are in a filtered view, click Show All on the upper-right to view the available Roles.

3. Select one or more Roles, and then click OK.

Automate Reminders

These settings define when to send approval reminders to approvers who have not responded. You can specify different reminder intervals for each urgency level. A setting of 0 sends no reminders.

1. Next to Reminder Intervals, click Manage Reminder Intervals.

2. Enter a number for the Urgency Reminder Interval (Low, Normal, High, Critical).

   • At 0, the strategy sends no reminder.

   • When the request times out, the approval request fails.

3. Click OK.

Manage Expiration Timeouts

These settings specify the amount of time after which an approval request will time out. If backup roles have been specified, the request will be sent to the backup approvers, else the approval request will fail. You can specify different reminder intervals for each urgency level. A setting of 0 sends no reminders.

1. Next to Approval Timeouts, click Manage Approval Timeouts.

2. Enter a number for the Urgency Approval Timeout Duration (Low, Normal, High, Critical).

   • At 0, the strategy sends no reminder.

   • If the request times out, the approval request fails.

3. Click OK.

4. Click Create Approval Layer, and then click Save.

Add Communication Providers

Adaptiva supplies default Communication Providers that you can use here, or you can create your own. To create new Communication Providers that you can choose when creating Chains, see Communication Providers.

1. Next to Communication Providers, click + Browse.

2. Select one or more providers to add to the Approval Chain.

3. Click OK, and then click Save.

Apply Chains to Your Environment

Patching Strategy and Business Unit object templates include an Approval Chains dialog so you can define administrative approval details as part of the object.

Use this procedure to assign existing Approval Chains to a Patching Strategy or Business Unit template. This procedure assumes you have opened and saved an object template and are ready to configure the Approval Chains.

Link Approval Chains to a Patching Strategy

Basic Strategies create read-only Approval Chains when you add transitions. You only need to explicitly link an Approval Chain when you are using Advanced Strategies.

1. From within the Strategies editing area, select Approval Chains to open the Approval Chains workspace.

2. Click Browse next to the type of Approval chain you want to add (Product Owner, Patch Management, Security, and so on).

   
3. Select an Approval Chain from the Approval Chains table.

   
4. Click OK to return to the object template.

5. Repeat Steps 2 through 4 for each of the groups listed in the Approval Chains workspace:

   • Skip any groups that do not apply to your situation.

   • When each group from which you need an approval contains an approval chain, continue with the next step.

6. Click Save at the upper-left to save your progress:

   a. Check the Error View and resolve any errors.

   b. Click Save again if you make any changes.

Link Approval Chains to a Business Unit

Adding Approval Chains to a Business Unit is an advanced feature. The Approval Chains fields allow advanced users to specify details for use in customized Patching Strategies, Deployment Chains, or Business Units when necessary to achieve different results.

1. In an open Business Unit template, click Approval Chains. This opens the Approval Chains workspace.

   • Business Units inherit these settings from a parent by default. For more information about inheritance, see Parent and Child Business Units

     
   • Disable inheritance to enable Browse, and then assign a different Approval Chain to a setting.

     
2. Click Browse or something like Add Patch Management Chain next to the type of Approval chain you want to add (Product Owner, Patch Management, Security, and so on).

3. Select an Approval Chain from the Approval Chains table. This example uses an All Admins Approval Chain.

   
4. Click OK on the lower-left to return to the Approval Chains workspace.

5. Repeat Steps 2 through 4 for each of the groups listed in the Approval Chains workspace:

   • Skip any groups that do not apply to your situation.

   • When each group from which you need an approval contains an approval chain, continue with the next step.

6. Click Save.