GRC AC10 Agent based upon Role Attributes

Question

Hi Experts,
Need your help on the issue.
We are trying to achieve below configuration-
After the Access request is generated, at the first stage, the approver should be selected based upon the business process of the role. If there are multiple roles with different Business Processes and their approvers, all of them should approve the request and then request should go to the next stage.
There is also a field Business Process in the Access Request Screen which denotes the User's association with Business Process and not of the role. We are able to trigger the approval based upon this field, but we can;t find any option of approver selection based upon the business process of the role.
Can some one show a way to achieve that?
We are facing another problem, when the request is approved based upon the field Business Process in the Access Request screen, we are not able to find the request in next stage, it is still showing in the same stage while the role attached is only one and no other approver defined.
What could be the reason behind it? Any help is highly appreciated.
Thanks in advance,
Sabita

Answer 1

Hello Sabita,
You can use the transaction : GRFNMW_DBGMONITOR_WD to check the logs.
What i understand from your requirement and what would be my approach.
1) Approvers who will be ROLE OWNERS
> In this case 1st thing is you should upload few ROLES( NWBC>Access Mgmt-->Role Import) with all the details i.e function area, company , role owner, alternate approver
---> Now create a "Custom Initiator from SPRO >GRC>AC>workflow for access control>Define  Worflow Related to MSMP rules for Process ID SAP_GRAC_ACCESS_REQUEST
Run Tx: BRF+ , and you will see a rule created , drill down to "Expression-->Decision Tree"
and use "Table settings" to select "Condition Column" & "Result Rule sets", where you can configure the Custom Initiator
Now run Open MSMP workflow config window
1) Process Global settings ( Notification details if necessary)
2) Maintain Rules (add your custom initiator rule )
3) Maintain agents ( check & if not present add Role owner agent)
  i.e. GRAC_AR_ROLE_OWNER  (This will satisfy 1 st requirement)
Create a new agent as BSM and mapp them as "directly mapped user" , similarly for the 3rd stage you can use directly mapped user.
4)Variables & Templates --> Skip
5)Maintain Path ( add 3 stages as required i.e role owner, BSM & security officer)
Now for each stage click on "modify Task Settings" & click on individual check boxes as relevant , you can select "All approvers" or "Any one approver", Approve Request based on System & Role , or Request .
Same applies to all the other 2 stages.
6) Maint Route Mapping  --> put the path ID created in previous stage and save and activate.
I hope this should give you some fair idea.
Thanks
Victor