Stop customers from being added as approvers manually

[Monica Yost]

Hi I am trying to prevent customers from being added manually as approvers to projects that they are not even customers on ?

We have multiple projects which are security sensitive , when you create your own change request you have to manually add the approvers and an analyst accidentally added a customer of the same name . How can we stop this from happening?

[Capi [resolution] · Accepted solution]

Hi @Monica Yost 

You probably have to build a customization that blocks wrong customer approvers. A validator would perhaps be possible without using a script or add-on. 

But then, if you're already using any good workflow management add-ons, those will give you extra options and their support may be able to help quite fast.

[Monica Yost]

Thanks Capi 

If I was to use a validator do you know how How would proceed as I do have this plugin ?

[Capi [resolution]]

Which plugin specifically?

[Monica Yost]

We had the 

Jira Misc Workflow Extensions 

It seems its expired , but if I was to get this back would it be the right plugin to help with this issue?

[Capi [resolution]]

That's my guess but it's just a guess. Their documentation does give examples of. blocking a transition from being approved with their scripted validations, but what you want is a bit different.

My other guess is that you need to restrict the permissions in that step of the workflow to only users, there might be some ideas here.

I've asked in the Leaders Slack channel to check if anybody else has experience with this, hopefully they can be more specific.

[Mike Rathwell]

Without question, JMWE can do this. That has become a Swiss Army Knife tool that I cannot live without both on Server and Cloud. 

The power of validators, conditions, and post functions that vary between point and/or shoot to set up coupled with full on Groovy on Server and Nunjucks on Cloud to do stuff outside the "box" let you do all manner of things.

In this case, you could either have a negative case (look for customers) to not be allowed to approve OR a positive one (look for who you allow) to be set as approver.

The OTHER thing I have done for some service desks is take the ability to set an approver totally out of most people's hands and set it based on automation. For those there is NO way to set an Approver manually at all. 

[Capi [resolution]]

Thanks for chipping in @Mike Rathwell !

[Monica Yost]

Thanks Both 

[Patrick Ransom]

@Mike Rathwell .. when you stated that for some service desks you've taken the ability to set an approver totally out of most people's hands and the approvers are set based on automation. Does this pertain to agents as well? We're attempting to lockdown some request types, preventing everyone (including agents) from modifying/removing the approvers we've set via automation...but it appears that the agents still have the ability to modify them. Would appreciate any insight or suggestions. Thanks!