Skip to main content
A review workflow sends an agent intake to the teams that must look at it before it is approved. Each team is a responsibility. A review policy says which responsibilities an intake needs. A policy is optional. Until one is published, an intake has no review steps and approval follows only the approver count and the same-person rule (Set who approves intakes).

​
Who does what

The author of a policy cannot publish it. One administrator can do everything except publish, so a second person with review:publish is needed.

​
Set it up

1

Create the responsibilities

In the Console, open Govern → Review workflows → Responsibilities. In New responsibility, enter an identifier (lowercase, for example privacy), a label, the remit and the evidence reviewers expect, then select Create responsibility.
Review workflows Responsibilities tab showing the privacy responsibility with two members

Responsibilities, with a responsibility's members shown.

2

Give each one people

Select Show members on a responsibility. Add people by principal id, bind a group with Bind group, or let a member delegate their seat for up to 30 days. Do this before publishing. Nothing checks that a responsibility has members, and a mandatory step with nobody in it cannot be cleared. If that happens, add a member. The intake does not need to be revised.
3

Draft a policy

Open Routing, select Start a draft, edit the JSON and select Create draft. The next section has an example, and the policy reference has the full format.
Review workflows Routing tab showing published version 1 and its policy JSON

Routing: a published version and its JSON.

4

Validate it

Select the draft, then Validate. Problems are listed as path — code: message. A draft is never edited, so fix problems in a new draft.
5

Test it

On Test & publish, Simulate routing shows which steps a sample intake would get. Preview impact on open intakes shows what the version would change. Neither changes anything.
Test and publish tab simulating a personal data intake, which gets the privacy-review step

Test & publish: the Personal data sample routes to the Privacy review.

6

Publish it

A different user with review:publish selects Publish version N on Test & publish. It applies to new submissions only.

​
Example

This policy adds a mandatory Privacy review to every intake that lists pii as a data class. It needs one person at most tiers and two at HIGH. It needs an active responsibility named privacy with members.

​
Review an intake

When an intake was routed by a policy, its page shows a Review progress card. A reviewer with a seat selects Clear this step on a mandatory step, or adds a note. On a mandatory step a note is Advice, Changes requested or Refusal. An advisory step takes Advice only. The approver acknowledges any advice and then approves. The submitter never clears a mandatory step, and the final approver needs no seat. These review conditions refuse approval. Other conditions can too, such as an unconfirmed requester.

​
Good to know

  • An intake keeps the policy version that was published when it was submitted. To move it to a newer policy, withdraw it and submit again.
  • An intake submitted before any policy was published never gets review steps.
  • Revising an intake routes it again and makes earlier approvals and notes stop counting.
  • Review workflows are not available when the appliance is in evidence-only mode.