Appearance
Multi-Eye Approvals
Approval depth in OrviQ is described by how many pairs of eyes see a decision before it becomes authoritative.
The three depths
| Depth | Structure | Meaning |
|---|---|---|
| Four-eye | Maker, then Checker | One person acts; a second, independent person approves |
| Six-eye | Maker, Reviewer, Approver | An independent review stage and a separate approval authority |
| Eight-eye | Maker, Reviewer, Approver, Management | An additional senior or committee stage |
Each review stage enforces segregation of duties independently. A six-eye chain requires three distinct people, not two people acting twice.
Which objects use which by default
| Object | Default chain | Escalation available |
|---|---|---|
| Requirement demonstration | Work, Department Review, Compliance Review, Management Approval | Escalate at compliance review |
| Finding | Work, Review, Close | — |
| Policy | Draft, Compliance Review, Published (four-eye) | Six-eye template available |
| Exception | Draft, Review and Approval (four-eye) | Six-eye template available |
| Risk acceptance | Request, Risk and Compliance Review | Escalate to executive or CCO approval |
| Applicability decision | Draft, Independent Compliance Review | Escalate to executive or CCO approval; six-eye template available |
| Control mapping | Draft and propose, Independent Mapping Review | — |
| Audit plan | Draft, Audit Review and Approval | — |
| Audit engagement sign-off | Fieldwork, Independent Audit Review | Escalate to executive or CAE sign-off |
| Regulatory response | Draft, Independent Compliance or Legal Review | Escalate to executive or committee approval |
| BIA | Draft, Risk and Continuity Review | Escalate to business or committee approval |
| Continuity plan | Draft, Continuity Review | Escalate to executive approval |
| Resilience exercise | Conduct, Independent Review and Sign-off | Escalate to executive sign-off |
| Resilience assessment | Assess, Resilience Review and Sign-off | — |
| Incident closure | Investigation, Independent Review and Closure Sign-off | Escalate to executive or risk committee |
| Third-party engagement | Prepare, Risk Review | — |
Defaults are tenant-configurable. See Workflow Templates.
Transitions available at a stage
| Transition | Effect |
|---|---|
| Forward or Submit | Advance to the next stage |
| Approve | Approve, typically to a terminal stage |
| Return | Send back to the work stage with comments |
| Reject | Decline, to a terminal rejected stage |
| Escalate | Move to a higher approval stage |
Not every stage offers every transition. A work stage typically offers only forward.
Return versus reject
These are different acts with different consequences, and choosing correctly matters.
| Return | Reject | |
|---|---|---|
| Means | This needs work | This should not proceed |
| Goes to | The work stage | A terminal rejected state |
| The submitter | Revises and resubmits | Starts again if they proceed at all |
| Use when | The substance is sound and something is missing or wrong | The proposal is fundamentally not right |
Most reviewer feedback is a return. Rejecting work that needed a small correction wastes the analysis behind it.
Choosing a chain depth
Choose by consequence, not by seniority of the submitter
The question is not "who submitted this?" It is "what happens if this is wrong and nobody catches it?"
- Four-eye is right for most operational governance: mappings, ordinary exceptions, standard policies.
- Six-eye is right where the decision has material external consequence: a regulatory response, a material outsourcing decision, a board-level policy.
- Eight-eye is right where a committee genuinely needs to see it, and where the delay is acceptable.
Over-deepening chains is not free. A six-eye chain on routine approvals produces a bottleneck, and bottlenecks produce workarounds.
Roles at stages
Stages bind to tenant RBAC role keys — strings your administrator can remap. The workflow engine has no notion of what a role means; it routes to whoever holds the bound role.
Some stages use a resolver instead of a fixed role: owner resolves to the record's owner, owner_department_head to their department head.
Permissions
| Action | Permission |
|---|---|
| Define workflow steps | workflow.configure |
| Assign step responsibility | workflow.assign |
| Approve workflow transitions | workflow.approve |
| Administrative override | workflow.override |
Plus the domain permission for the object being approved.
Example
A bank's chain configuration.
| Object | Chain | Reasoning |
|---|---|---|
| Control mappings | Four-eye | High volume; the consequence of a wrong mapping is a coverage error that assurance will surface |
| Ordinary exceptions | Four-eye | Compliance Manager approval is proportionate |
| Exceptions on critical systems | Six-eye | Risk review, then CRO approval |
| Standard policies | Four-eye | Compliance review |
| Board-level policies | Six-eye | Compliance review, then executive sign-off |
| Risk acceptance | Six-eye with escalation | Risk review, escalating to CRO where residual is beyond appetite |
| Regulatory responses | Six-eye | Legal review, then CRO approval — the response is a formal representation to a supervisor |
| Incident closure, Critical severity | Six-eye | Operational risk review, then risk committee |
| Incident closure, other | Four-eye | Operational risk review |
Volume through the chains in a quarter:
| Chain | Decisions | First-time approval rate |
|---|---|---|
| Four-eye | 1,847 | 87% |
| Six-eye | 62 | 61% |
The lower first-time rate on the six-eye chain is the expected result, not a problem. Those are the decisions with material consequence, and 39% of them needed something changed.
Troubleshooting
"A six-eye chain approved with two people." It cannot. Each stage enforces segregation independently. Check whether the second person held both stage roles — that is a role design issue, not a workflow one.
"The final approval did not change the business state." Only the terminal stage updates business state. Check whether the chain reached its terminal stage.
"I want a different depth for one object type." Chain depth is set through workflow template bindings. See Workflow Templates.
"Escalation is not available." Not every chain has an escalation transition at every stage. Check the template.