How do you confirm the identity of an approver in an approval request?

Robert Mann

We discovered somewhat alarmingly that the Modified By column does not record the email address of a person making an approval but rather pulls information from the cell in the approver column. Here is the use case: An approval request email is sent to Person A, who forwards the email to Person B. Person B approves the request. Both the approver column and the Modified By column will record Person A as the one approving in the cell history. Thus, how do you confirm the identity of the individual actually making the approval? This is a true approval workflow and an update request workaround will not owrk.

Humashankar

Kindly have a look in to the audit trail feature that tracks changes made to cells, including approval actions - kindly check select 'View Cell History' to get the right approver name

Hope this helps!!

Warm regards

Robert Mann

Thank you for your response @Humashankar. The source of the issue is that the cell history records the wrong value. The person who actually made the approval never appears in the cell history. Instead, the value in the approver contact column is simply inserted into the Modified By cell history. On can assume that the person receiving the approval email will be the one taking action, but not always. Anyone who has the link to the approval page can take action, and a forwarded approval email results in an incorrect audit trail in the cell history. We need the approval request workflow (i.e. not an update request self-select workaround), but we also need the cell history to be accurate.

Humashankar

Thanks for adding more insight

Looks it is more of a issue with inaccurate cell history and it is purely in to the approval workflows

This is definitely a unique issue.

Let me think more on this, meantime lets see some other experts in the forum able to direct us.

Paul Newcome

Why would the update request not work?

The approval workflow records who the approval was sent to from the system. It does not continue tracking after it leaves Smartsheet's environment other than awaiting a response. This allows users to not be signed in just to respond.

Robert Mann

We have a wide range of approvers who have no experience in Smartsheet, and sending them a list of editable fields with instructions on what to change and not change in an update request is a non-starter. Our audience is already struggling with the simplicity of the approval page as we pilot that functionality.

If the identity of the approver is anonymous by design (no tracking outside Smartsheet and a link that can be utilized by anyone who clicks it first), then a foundational requirement of an approval workflow has been missed. This may be tolerable for small and incidental requests, but not for personnel decisions and large projects.

I am more troubled by the Modified By column recording the "sent to" cell data as the actor in the approval action. If there is no tracking of the actor after the email leaves the system, then this is an assumption and breaks the audit trail.

And back to the original question: 🙂 A way - 3rd party, API, code - to validate the actor (at minimum email address) in the approval workflow?