# Manual Ticket Approval

**Categories:** Security

Adds a real approval step to any ticket on demand, with tiers, strategies, reminders, and a timeout, and writes the decision back to the ticket.

- Started manually by an admin on any ticket
- Sends the approval request to named approvers or ordered tiers
- Supports any, all, and fallback approval strategies
- Nudges approvers on a configurable reminder schedule
- Times out after a configurable window, 48 hours by default
- Writes the decision back onto the ticket automatically

## What Manual Ticket Approval does

Manual Ticket Approval is the approval step for everything that does not have one. An admin adds it to any ticket, and the agent sends a real approval request - to named approvers or through ordered tiers, using any, all, or fallback strategy - with its own title and message, reminder nudges, and a timeout. The response is written back onto the ticket, so the decision lives with the request rather than in a chat thread. It exists because no catalogue of pre-built workflows covers every case where someone needs a documented yes.

## Who Manual Ticket Approval is for

**Persona:** Service desk admins and team leads who need a documented approval on a request that no existing automated workflow covers.

**Pain point:** Purpose-built workflows have approval baked in. Everything else does not, so approvals for the unusual request happen in chat: someone asks a manager, gets a thumbs-up, and pastes a screenshot into the ticket if they remember. There is no reminder if the approver is away, no defined escalation, no timeout, and afterwards no clean answer to who approved this and when.

## How Manual Ticket Approval works

**Trigger:** An admin manually adds approvers to an existing ticket. The workflow ships disabled and must be turned on.

1. **Send the approval request** — Delivers the request to the approvers or the ordered tiers supplied, using the chosen strategy, with a title and message that can be set per request and defaults supplied when they are not.

2. **Remind and wait** — Nudges approvers on the configured reminder intervals and waits out the timeout window - 48 hours unless overridden.

3. **Record the decision on the ticket** — Writes the response back onto the ticket as part of the same step, so the approval and the request stay together.

4. **Escalate on failure** — If the approval cannot be completed, the ticket is reopened, unassigned, and annotated internally with the reason, so it lands back with a human rather than disappearing.

**Outcome:** A documented approval attached to any ticket, chased on a schedule, bounded by a timeout, with the decision recorded where the request lives.

## Capabilities

- **Works on any ticket** - Attaches an approval step to a ticket on demand, rather than requiring a purpose-built workflow.
- **Ordered approval tiers** - Requests can run through tiers in sequence, or go to a single list of approvers as a fallback.
- **Any, all, or fallback strategy** - Choose whether one approver is enough, everyone must respond, or the request falls through in order. Defaults to any.
- **Nudge reminders** - Reminder intervals are configurable per request, so a pending approval is chased without anyone doing it manually.
- **Bounded by a timeout** - Every request has a deadline - 48 hours by default - so approvals do not hang indefinitely.
- **Custom title and message** - The approval notification carries the wording you supply, with sensible defaults when you do not.
- **Decision written to the ticket** - The response updates the ticket automatically, keeping the audit trail in one place.
- **Escalation on failure** - A failed approval reopens and unassigns the ticket with an internal note, so it returns to a human.

## Main use cases

**A one-off request that needs a documented yes** - An employee asks for something no workflow covers - an exception, an unusual purchase, a non-standard configuration. The admin attaches an approval, the right person decides, and the answer is recorded on the ticket instead of in a chat thread.

**Approval that survives someone being away** - The first approver is on leave. Nudges chase them, the tier structure moves the request on, and the timeout stops it from sitting open forever - none of which happens when approval is a direct message.

**Making an exception auditable** - A policy exception is granted. Because the approval ran through the agent, who asked, who approved, and when are all on the ticket when a reviewer comes looking.

## Integrations

```json
{
  "_key": "manual-ticket-approval-int-t",
  "_type": "table",
  "rows": [
    {
      "_key": "manual-ticket-approval-int-t-r0",
      "_type": "tableRow",
      "cells": [
        "Integration",
        "Role in the agent flow"
      ]
    },
    {
      "_key": "manual-ticket-approval-int-t-r1",
      "_type": "tableRow",
      "cells": [
        "Harmony Service Desk",
        "The ticket the approval is attached to, and where the decision is written back"
      ]
    },
    {
      "_key": "manual-ticket-approval-int-t-r2",
      "_type": "tableRow",
      "cells": [
        "Your connected identity provider (e.g. Okta, Microsoft Entra ID, Google Workspace)",
        "Resolves the requester and the approvers named on the request"
      ]
    },
    {
      "_key": "manual-ticket-approval-int-t-r3",
      "_type": "tableRow",
      "cells": [
        "Harmony Notifications",
        "Delivers the approval request and its reminders through each approver's preferred channel: Slack, Teams, or email"
      ]
    }
  ]
}
```

## FAQ

### When would I use this instead of a purpose-built workflow?

When no workflow covers the request. Application access, group membership, and the rest have approval built in. This is for everything else - exceptions, unusual asks, one-off decisions - where you still want a documented approval rather than a chat message.

### What approval strategies are supported?

Any, all, and fallback. Any means one approver is enough, all means everyone must respond, and fallback moves through approvers in order. Requests can also run through ordered tiers. The default is any.

### What happens if nobody responds?

Approvers are nudged on the configured reminder intervals, and the request times out after its window - 48 hours unless you override it. If the approval cannot complete, the ticket is reopened and unassigned with an internal note so a human picks it up.

### Does the decision end up on the ticket?

Yes. The response updates the ticket as part of the approval step, so the request and its decision stay together rather than living in a separate approval log.

### Who can start one?

It is a manually triggered workflow: an admin adds approvers to an existing ticket. It does not fire on its own, which is the point - it is the escape hatch for cases automation does not anticipate.

## Related agents and features

- [**Application Access Request**](/agents/application-access-request) - Application access with approval and provisioning already built in, for the case this agent generalises
- [**Domain Access Security Approval**](/agents/domain-access-security-approval) - Multi-stage approval for sensitive access, with posture checks and time-bound grants
- [**Group Membership Management**](/agents/group-membership-management) - Identity group changes with their own approval flow
- **Harmony Service Desk** - Receives the tickets this agent opens and carries the audit trail of what happened