Question

Why all users can approve/reject an approval from the approval tab

20:42 Nov 21, 2021

Hi,

We are starting to use approvals but there is one thing I can't understand.

I added an approval record through the Send for approval action. I set the approver to a specific user (Alex). But when I log in as a different user (David), I can approve or reject the approval record I created before (by pressing the 3 dots).

I would think the only Alex can approve since he is the approver.

Can anyone explain that to me?

Thanks,

Chani

3 comments

Vladimir Sokolov

22:06 Nov 21, 2021

If David has Alex's rights (as his manager e.g.) he can approve his approvals

Chani Karel

14:10 Nov 22, 2021

But he is not!

David has just the All Employees role, and he can approve/reject Alex's approvals or other roles too.

Oleg Drobina

16:36 Nov 22, 2021

Hi Chani,

You need to check the table that stores approval records rights. For example if approval was enabled for invoices the table is callled SysInvoiceVisaRight. The query should be the following:

SELECT * FROM SysInvoiceVisaRight
WHERE RecordId = ''

RecordId is an Id from the InvoiceVisa table (it stores all visas for all invoices in the system). So the query should be:

SELECT * FROM SysInvoiceVisaRight
WHERE RecordId IN (SELECT Id FROM InvoiceVisa
WHERE InvoiceId = '')

InvoiceId can be retrieved directly from the URL bar of the browser when the Invoice is opened.

The user or role is stored in the SysAdminUnitId column of the SysInvoiceVisaRight table. You need to check which users and\or roles are stored in the SysInvoiceVisaRight table analogue for your section.

Also try checking default record permissions for the approvals object for your section in the "Object permissions" section (in System designer).

Best regards,

Oscar

Show all comments