← All modules
smartWorkflow icon

smartWorkflow

Full flexibility in approval flows - with preventive SoD check before access is granted.

smartWorkflow provides full flexibility in configuring workflows for permission management processes. The built-in SoD risk database enables proactive "what-if" analysis during authorization request approval. The system automatically assigns authorizations and uses an intuitive workflow to track the process, sending email notifications to all participants.

play_circleTry the live demo calculateCalculate your ROI auto_awesomeSee AI Agents
auto_awesome Our AI vision (in development)

AI agents in smartWorkflow

2 agents handle the routine work in this module and escalate only what needs a human. Each agent has its own autonomy dial - your governance officer chooses how much the agent does and where humans stay in the loop.

shield_lock

Your governance officer owns the dial

Per agent, per environment, per risk level - tighten or loosen autonomy without redeploying code or filing engineering tickets. The agent never decides its own permission level. Business rules decide, and your team owns the rules.

Off
No AI
Suggest
AI advises
Approve
Human gate
Auto
Rules-governed
Agent 1 of 2 . Onboarding Assistant

AI Onboarding Assistant

Agent recommends a complete role package for a new hire based on successful peer profiles in the same role and department. Day-1 productivity instead of two weeks of permission tickets.

tune AI autonomy level
Off
Suggest
Approve
Autonomous
New hire - role recommendation
smartWorkflow
New hire
K. Mazur
Position
Junior FI Accountant
Department
Finance . Warsaw
Start date
01 Jun 2026
auto_awesome AI ROLE PACKAGE Based on 18 peer profiles in Finance / Warsaw
SAP_FI_END_USER
17/18 peers have this . core FI display + posting
94%
Z_FI_REPORT_VIEWER
16/18 peers . local FI reporting
89%
SAP_GENERAL_USER
18/18 peers . MM display, calendar, communication
100%
SAP_FI_APPROVE
4/18 peers - only senior accountants. Skip for junior.
22%

Illustrative mockup from the smartWorkflow new-hire flow. Each suggested role shows match rate with peer profiles; users can accept or trim.

What you see
  • looks_oneNew-hire context: position, department, location.
  • looks_twoAI ROLE PACKAGE with match-rate to peer profiles.
  • looks_3Each suggested role shows: who has it, why, exclusions for risk.
  • looks_4Approver can accept, customize or trim before submission.
trending_up

Day-1 productivity, fewer follow-up tickets

New hires start with a working role package on day one. Two weeks of 'I'm missing permission for X' tickets disappear.

Agent 2 of 2 . Workflow Pre-Approval

AI Workflow Pre-Approval

Agent pre-approves routine access requests, leaving humans to focus on exceptions and high-risk cases. Manager workload drops; SLA improves.

tune AI autonomy level
Off
Suggest
Approve
Autonomous
Access request queue - today
smartWorkflow
Today
47
AI pre-approved
31
Manager review
16
PRE-APPROVED
REQ-008341 . J. Nowak . +SAP_FI_REPORT
15/18 FI Controllers have it . in scope of position
auto_awesome AI 0.92
PRE-APPROVED
REQ-008342 . M. Wisniewska . +SAP_MM_DISPLAY
Read-only . standard for Buyer role
auto_awesome AI 0.97
MANAGER REVIEW
REQ-008343 . T. Kowalski . +SAP_FI_APPROVE
SoD overlap with existing SAP_FI_POSTING . manager judgment needed
escalator_warning ESCALATE
PRE-APPROVED
REQ-008344 . A. Lewicki . +Z_SD_PRICELIST_VIEW
Standard role for SD Sales . no risk overlap
auto_awesome AI 0.89

Illustrative mockup from the smartWorkflow request queue. PRE-APPROVED rows flow through automatically; ESCALATE rows route to a human reviewer.

What you see
  • looks_oneQueue overview: today's volume + AI vs manager split.
  • looks_twoPRE-APPROVED rows include peer match and AI confidence.
  • looks_3MANAGER REVIEW rows show why they were escalated.
  • looks_4Manager can override AI decision in either direction - all logged.
trending_up

Routine requests evaporate

Median time-to-access for routine requests drops from days to seconds. Manager workload concentrates on the 30% that genuinely needs thought.

auto_awesome See all 19 AI agents

Key features

smartWorkflow · New hire onboarding
MK
Magdalena Kowalska · New hire
FI Specialist · Warszawa · Joins 02.06.2026
DRAFT REQUEST
auto_awesome
Agent suggests 5 roles based on peers

Analyzed 11 FI Specialists in Warszawa department with same job code. Recommended package below; confidence 0.88.

Z_FI_AP_POSTING
Used by 11/11 FI Specialists in this team
100% peers
Z_FI_AP_VIEWER
Used by 10/11 FI Specialists
91% peers
Z_FI_GL_REPORT
Used by 11/11 FI Specialists
100% peers
Z_SD_VIEWER
Used by 8/11 FI Specialists (for cross-checks)
73% peers
Z_FI_AR_POSTING (optional)
Used by 4/11 FI Specialists - manager decision
36% peers

Illustrative mockup. The Onboarding Assistant Agent recommends a complete role package based on peers with the same job code in the same team.

What you see
  • looks_oneAgent pre-fills the role package based on what peers actually use, not theory.
  • looks_two% of peers using each role visible - manager decides on edge cases.
  • looks_3Optional roles surface for explicit review, not as default.
trending_up

Day-one productivity

No more back-and-forth tickets. New hire gets the right access on day one based on what their team actually needs.

check_circle

Configurable flows

Any structure: Manager → Security → Process Owner → Audit. Per request type, per system, per risk.

check_circle

"What-if" SoD analysis

Before approval: the system shows whether granting this role will create a new SoD conflict. Conscious decision.

check_circle

Automatic provisioning

After approval - permissions go to SAP / target system without manual admin clicking.

check_circle

Email notifications

Every participant gets a notification with an action link. Escalation when no response in X days.

check_circle

Full audit trail

Who requested, who approved, what SoD risks were present, what controls were applied. Audit material.

check_circle

Self-service for users

Employee submits requests through an intuitive portal - no helpdesk emails.

Typical use cases

FAQ

Frequently asked questions about smartWorkflow

What workflows does smartWorkflow automate? expand_more

smartWorkflow automates the request → approval → provisioning → review lifecycle for SAP access. Key workflows out of the box: Access request (role assignment), Firefighter request (emergency access), Role modification (change a role definition), Periodic review campaign (recertification), De-provisioning (leaver workflow). All workflows include four-eyes approval, audit trail, and SLA tracking.

Does smartWorkflow support auto-provisioning? expand_more

Yes. After approval, smartWorkflow can auto-provision the role assignment in SAP (via SU01, PFCG, or BAPI/RFC). What-if analysis runs before provisioning: shows the resulting effective authorizations, SoD impact, and SoD conflict alerts. If a conflict would be created, the workflow blocks or escalates per the configured policy.

How does smartWorkflow integrate with our existing ticketing (ServiceNow, Jira)? expand_more

smartWorkflow integrates bidirectionally with ServiceNow, Jira Service Management, and most ITSM tools via REST API. Pattern: ticket created in ITSM triggers smartWorkflow approval; smartWorkflow updates ticket with approval decision and provisioning status. This keeps the user-facing ticket experience in your existing ITSM while access governance happens in smartGRC.

What approval workflows are supported? expand_more

smartWorkflow supports single-approver, dual approval (four-eyes), tri-party approval, and conditional escalation based on risk class. Each role can have its own workflow definition - e.g., low-risk roles get single-approver, Firefighter access gets dual approval, SOX-relevant roles get tri-party. Approvals are mobile-friendly (email + clickable approval links).

Can smartWorkflow handle joiner/mover/leaver workflows? expand_more

Yes. The leaver workflow is critical for audit compliance: when HR signals an employee departure, smartWorkflow triggers automatic de-provisioning of all SAP roles within the configured SLA (typically same-day for SOX-relevant). Joiner workflow assigns the "starter pack" of roles based on department/job code from HR. Mover workflow recalculates access when an employee changes departments.

Is smartWorkflow audit-trail complete? expand_more

Yes - this is a core compliance requirement. Every workflow step is logged: who requested, who approved, who provisioned, what was provisioned, when. The audit trail is exportable in CSV/XML formats acceptable for Big 4 auditors. Workflow history is retained for the configured period (typically 7 years for SOX-relevant data).

How is smartWorkflow licensed? expand_more

smartWorkflow is included in the Enterprise plan (custom pricing, full governance). Auto-provisioning and what-if simulation are Enterprise-only features. Professional plan includes manual approval workflows without auto-provisioning. See pricing tiers.

Can I test smartWorkflow without commitment? expand_more

Yes: the interactive demo includes the smartWorkflow approval interface with sample requests. For a custom workflow PoC on your actual SAP landscape, contact us for a 30-day pilot.

Ready to see it live?

Try the interactive UX preview - no signup, no credit card.

play_circleTry the live demo Book a real demo