Access Control Roles

This article will describe User types, Approver types, and Approver status

Artifact Access Control:

Owner: The user that is ultimately responsible for the training. Owners have the ability to edit, manage, and share the training with Consumers. Additionally, Ostendio will notify the Owner when the training is set to expire so that they can review it. Each training can have only one Owner.

Custodian: These users have the ability to edit, manage, and share the training with Consumers as the Owner. Custodians will not be notified when the training is set to expire. 

Consumer: Everyone who is required to review and acknowledge the training, as set by owners or custodians. They will not have admin rights to make changes to the training. Consumers have "View only" permission on items.

View Audience:  These users can only view documents or trainings. Actions for these users are not generated, meaning they do not receive actions to perform.

Note: Custodians, Consumers, and View Audience can be added individually or in bulk.

For more information, please see Document Access Control in Ostendio

Pre-approver

• This is the person who must complete ticket approval before the Ticket can be resolved. Pre-approval could need users to look at attachments or the ticket itself.

• • Sample business cases:
    • • Purchase pre-approvals
      • Pre-approval before allowing the Ticket task to be commenced
      • Pre-approval for Ticket configuration process

• If there are any mandatory pre-approvers, they must approve the Ticket before the task for the Ticket Owner will be generated by Ostendio.
• If there are only optional pre-approvers, the Ticket Owner will receive their pending task immediately. 

Post-approver

• This is the person who must take the action to approve a ticket before the Ticket can be closed, but after the task has been completed and the ticket has been resolved. 
• The post-approval process for tickets allows users, custodians, admin, and managers to review and validate actions taken after tickets are initially resolved to ensure proper protocols are followed. This also creates an auditable record of the actions taken for each ticket from creation to final resolution for governance, risk management, and compliance purposes.

• • Sample business cases:
    • • Evidence reviews
      • Internal Ticket management process verification

• If there are only optional post-approvers, the Ticket Owner can close the ticket without requiring this approval.

• If there are any mandatory approvers, the Ticket Owner can only resolve the ticket, before sending it to the mandatory post-approver to complete their approval before the ticket can be closed

Approver Types:

Optional Approver: The approval workflow will move forward without waiting for the optional approvers if either all mandatory approvals are made or an Authorized Approver has approved the Document

• No obligations to approve
• They have the option and ability to approve or reject 

Authorized Approver: The approval workflow will move forward when one of the authorized approvers on the same cycle approves the document

• Authorized means you have the authority to approve but you do not have to approve
• Only one of the authorized approvers’ approval let the approval process move on to the next cycle
• They have the option and ability to approve or reject

Mandatory Approver: The approval workflow would move forward ONLY if all of the mandatory approvers on the same cycle approve the document.

• In order to have the approval process move on to the next cycle, all Mandatory Approvers have to take action OR be removed from the Document as an Approver

Approver Status:

Not Started: The approvers have been added to the workflow but the training owner has not clicked the “Start Approval” button yet 

Active: The current cycle is in progress, the approval notification emails have been sent to the approvers, however, the approvers have not taken any approve/reject action yet

Pending:  The next Cycles have not started and the approval notification emails for the next cycles have not been sent yet 

Approved: The approval notification emails have been sent to the approvers and the approvers have approved the training.

Rejected:  the approval notification emails have been sent to the approvers and the approvers have rejected the training. 

Cancelled: The approvers have not taken approve/reject action yet but the training owner has decided to either publish the training or create a new draft of the training without waiting for the approval/rejection actions from the approvers.