When the Manager Is the Only Approver

In a lot of access request systems, one click from a manager is all it takes.

I still see this in companies large and small. The request goes to the manager, the manager approves, and the access is provisioned. No owner of the access weighs in. Nothing checks whether the person finished the training that access requires. Nobody takes a second look when the access is privileged or conflicts with something the person already has.

Managers are usually doing their best. Many approve because they trust that the person asking knew they needed it. That answers one fair question: does this person need this access to do their job, and for how long?

Approval is really more than one question, and the questions belong to different people. The owner knows the access from the inside: what it touches, who else has it, and whether one more person crosses a line. Some access comes with conditions, like required training or a rule against holding two kinds of access at once. When the manager is the only approver, none of that gets asked. The approval looks complete and answers one question.

It gets thinner for nonhuman identities and AI agents. Neither has a manager, so the request often goes to whoever built it. The sponsor should answer the first question. The owner still answers the second. And an agent will use every bit of what it is given, so it will find that gap long before anyone thinks to look.

I would not add approvers everywhere. That turns into delays and rubber stamps. The work is deciding where more than a manager is needed, and preparing the people who approve. That is People & Change, one of the five pillars of the operating model, and no tool does it for you.

Start with the access that carries real risk: privileged access, regulated data, and access that conflicts with other access. Add the owner for those. Auditors in regulated industries often expect it.

Let the system check conditions it can check, like completed training, instead of asking a person to remember.

Tell each approver which question is theirs, in plain words, on the approval screen. A few minutes of guidance at the moment of decision does more than an annual module.

AI can help by explaining what an item touches and flagging when a request reaches something sensitive. The approver still makes the call.

I have rarely met a manager who wanted to be the only brake between a request and a sensitive system. Most of them did not know they were.

Related

• Series 2 Post 10: LinkedIn post
• Series 3 Post 5: LinkedIn post
• Series 3 Post 6: LinkedIn post