The sym:approval allows users to request temporary and auto-expiring access to sensitive resources, called Targets. The requests are routed through fully-customizable escalation pathways, and a variety of community Targets are available.

👍

The sym:approval Template is defined at sym.sdk.templates.ApprovalTemplate.

Demo

Params

Flows that inherit from sym:approval require you to specify the following parameters.

params = {
    strategy_id = sym_strategy.okta.id

    fields = [{
      name = "reason"
      type = "string"
      required = true
    }, {
      name = "urgency"
      type = "list"
      label = "Urgency"
      required = false
      allowed_values = [ "Low", "Medium", "High" ]
    }]
  }

Steps

This template has several steps, each of which has a default implementation. You can override these implementations by implementing hooks in a Flow that inherits from sym:approval.

prompt

The prompt event fires when a user indicates their desire to request access to a resource (e.g. by using the /sym request Slack command). It reads the set of Targets from the Strategy specified in your Terraform.

request

The request event fires when a user has selected a Target to request access to, completing the necessary fields.

It reads the set of approvers to present the request to from the get_approvers reducer, and the text for the message to send to approvers from the get_title and get_message reducers.

It also reads the expiration time for this request from the get_timeout reducer, and schedules an expire event accordingly.

approve

The approve event fires when a user's request to access a given Target has been approved.

deny

The deny event fires when a user has been denied access to a given Target.

escalate

The escalate event fires when a user has successfully been granted access to a Target, via a Strategy.

deescalate

The deescalate event fires when a user's access to a Target has successfully been revoked.

Reducers

There are also several reducers available.

get_approvers

The only required reducer. Accepts an Event with a user and a target, and returns either a single User-like object, or a list of User-like objects.

get_timeout

Optional. Returns a datetime.timedelta indicating how long a request should remain pending before expiring.

get_title

Optional. Returns a string which customizes the title of the message sent to approvers.

get_message

Optional. Returns a string which customizes the body of the message sent to approvers.