How Sign-Offs and Multi-Level Reviews Work in Zluri

Zluri’s Access Reviews module supports multi-stage approval workflows to meet compliance needs that require multiple reviewers to validate user access across applications and groups. This ensures stronger oversight, separation of duties, and audit readiness.

Multi-Level Review Support

Zluri allows configuring up to 5 sequential levels of reviewers per entity (application or group).

Each level must have:

• A Primary Reviewer (unique across all levels)
• An optional Fallback Reviewer (can be reused across levels)

Example:

• Level 1 Primary Reviewer = Reporting Manager
• Level 2 Primary Reviewer = Department Head
• Fallback Reviewer = same named user for all levels (e.g., an IT admin assigned as backup)

Zluri enforces uniqueness for primary reviewers across levels to prevent redundant review paths.

Review Flow Across Levels

1. When a certification is launched, Level 1 reviewers are assigned based on the configuration.
2. These reviewers receive notifications and can begin reviewing assigned user records.
3. Reviewers must:
   • Take an action (Approve, Modify, Revoke) for each assigned record
   • Add comments (optional for approve actions, mandatory for modify and revoke actions)
   • Click Sign Off once all records are reviewed

Until sign-off:

• Reviewers can freely update actions and comments.
• No records are passed to the next level.

How Sign-Offs Work

A Sign Off in Zluri marks a reviewer’s task as complete. It acts as a formal confirmation that:

• All assigned reviews are finished
• No further edits will be made by the reviewer
• Records can now move forward in the certification lifecycle

Once signed off:

• Actions become locked for that reviewer
• The system checks if the next review level is configured

Next-Level Progression

If additional levels are configured:

1. Records are reassigned to Level 2 reviewers.
2. They see:
   • The user records assigned to them
   • The prior reviewer’s decisions and comments
3. Level 2 reviewers can:
   • Edit previous actions
   • Leave new comments
   • Sign off their level when ready

This process repeats through all levels defined in the certification.

Ready for Remediation

Once all levels have reviewed and signed off for a specific entity:

• That entity is marked as “Ready for Remediation” in the Admin View.
• When all entities in a certification reach this state:
  • The Certification Owner sees the “Conclude Review” button enabled.
  • Clicking this triggers the remediation playbooks (if configured).