Skip to main content

Approval Workflows (Card Templates)

Card Templates can require approvals before Credentials are issued. You can also route Duo ID approval requests to a delegated Tenant so approvals are handled in a central place.

Who this is for​

This page is for administrators who configure approval behavior for Card Templates.

Required Roles

Required roles: System Admin + Production - Create Layouts

To perform the following steps, you need to have the roles listed above.

Where to find approval settings​

  1. Navigate to Templates → Card Templates.
  2. Open a template and click Edit Card Template.
  3. Go to the Approvals tab.

Template approvals​

The Approvals section controls whether Credentials created from this template must be approved before they can be issued.

  • Click Change setting to update the approval configuration.
  • When enabled, the UI shows Enforced Approval activated.

Duo ID Approval Routing​

If your template uses Duo ID, you can delegate Duo ID approvals to a specific Tenant. This is useful when you want one Tenant (for example, “Central approvals”) to handle approvals for multiple Tenants.

Configure the delegated Tenant​

  1. In the Production elements tab, set Duo ID to Enabled.
  2. Go to Approvals.
  3. In Duo ID Approval Routing, select a Tenant in Duo ID Approval Delegated Tenant.
  4. Click Save.
Approvals tab showing Duo ID Approval Routing with the delegated tenant dropdown

What happens after you enable routing​

  • When a Duo ID request is submitted for a Credential created from this template, Breeze routes the approval request to the delegated Tenant.
  • Approvers review the request from the delegated Tenant’s Duo ID requests queue.

Disabled behavior​

If Duo ID is disabled on the template, the Duo ID Approval Routing section still appears, but shows a Disabled indicator and the dropdown is hidden.

Approvals tab showing Duo ID Approval Routing in the Disabled state
Routing timing

Routing is applied when the Duo ID request is submitted. Changing the delegated Tenant later does not move already-submitted requests.

Who can approve Duo ID requests​

To approve Duo ID requests in a Tenant, a user typically needs:

  • A base admin role (for example: Administrator) and
  • The task role Approver

See: Roles and Permissions