Validation of Approver Selection in JSM Approval Workflow

[Venkat Jira Admin]

We are using Jira Service Management. When a customer raises a request, the maker manually selects the checker from a multi-user picker field. Only one approval is required for the request to move to the next status.

My concern is that the maker can select any user from the group, whereas approvals should only be accepted from authorized approvers.

For example, assume the group contains users A, B, C, D, and E. User D is the maker, and only users A and B are authorized approvers. How can we restrict the maker from selecting unauthorized users such as C, D, or E as approvers? Alternatively, if an unauthorized user is selected, how can the system automatically reject the approval and ensure that only approvals from authorized users are considered valid?

[Marc -Devoteam-]

Hi @Venkat Jira Admin 

This is not possible using a multi picker field.

You could do this using assets, what is the relation of the approver to the reporter, user/manager or else.

Then you will need a user object in assets, with a user object and a manager object.

[Venkat Jira Admin]

Hi @Marc -Devoteam- 

Thanks for the reply.

Is there a way to prevent unauthorized users from approving requests by using workflows or automation rules?

Regards,

Venkat.

[Marc -Devoteam-]

Hi @Venkat Jira Admin 

Workflows or automations can't prevent this.

Even creating a group with less users as suggested by @Rilwan Ahmed will allow anyone in that group to be chosen as approver.

The only hard solution is based on using assets as I mentioned that you bas the approver(s) listed on another user or service on an asset object.

As they woul be the only ones listed to be choosen.

[Rilwan Ahmed]

Hi @Venkat Jira Admin ,

You can restrict the list of users who can be the approvers. For example: In a Organization of 100 employees, not all will be the approvers. May be 10 users will be the approvers. In this scenario, 

1. Create a user group or project role and add all approvers to it. 
2. Modify the field context and filter users using role or group. Steps as below.
   i.e. Go to Admin settings --> Work Items --> Fields ..> Search for the required field
   Go to field Context and values --> click on "Edit User Filtering" --> Click Enable group or project role filtering.
   Here you can add role where all approvers belong to or the group

[Germán Morales _ Hiera]

On the workflow side, a validator won't get you there: a JSM approval step is driven purely by who sits in the approver field, so there is no transition you can hang a per-approver rule on. The real lever is controlling what is allowed to land in that field.

The snag with your multi-user picker is that Jira's user filtering, the setting that limits a picker to a group, only exists on the single-user picker, not the multi-user one. Since you only need one approval anyway, the cleanest fix is to switch the field to a single-user picker and, under Custom fields then Configure then Edit User Filtering, restrict it to an Authorized Approvers group holding just A and B. The maker then simply can't select C, D or E.

If you would rather keep the multi-user field, enforce it with automation instead of trusting the maker: either set the approver yourself when the request is created, pulling A or B from that group or from an Assets lookup as Marc suggested, or run a rule that checks the chosen user's group membership and clears the field whenever someone unauthorized is picked. Either way, only authorized approvers ever reach the approval.