Approval thresholds

The Approval thresholds screen defines who may approve an order depending on its amount. It is the separation-of-duties safeguard on financial commitment: the more an order commits, the more senior the role required to validate it.

The principle: escalation tiers

Each tier is a rule: a ceiling (amount), a currency, and a required role.

When approving an order, its total amount is computed (Σ quantity × unit price, in the order’s currency) and the smallest tier whose ceiling covers that amount is found: its role is the one the approver must hold.

  • An amount above the highest tier ⇒ the highest tier’s role governs (the top also guards the overflow).
  • No tier for the order’s currency ⇒ free approval (no role required).

Example. Two EUR tiers: €1,000 → buyer, €50,000 → supply manager. An €800 order requires the buyer role; a €12,000 order requires supply manager; a €90,000 order requires supply manager (above the highest tier).

When the check bites

The check applies at the order’s approval. If the authenticated approver does not hold the required role, approval is refused. In the demonstration environment (no authentication) the check does not block — it becomes effective with real authentication, like the rest of RBAC. The total amount and the required role are shown on the order’s detail in all cases.

Managing tiers

  • New tier: ceiling + currency + required role (picked from the defined roles).
  • A tier can be edited or deleted. These writes are admin-secret protected and recorded in the sealed audit (thresholds govern a compliance rule).

See also