> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/administration-guide/reference/shipped-workflows.md).

# Shipped approval workflows

The 49 approval workflow definitions OpenIAM ships, the process IDs you configure against, and the delegate names that appear in the log when one fails.

## What this is, and when you need it

OpenIAM routes approvals through Activiti, and every approval flow is a BPMN 2.0 process definition; **49** of them ship. This page is the inventory. Use it to answer three questions: which definition drives a given operation, what process ID to reference when you configure approvals or protect a flow as a `WORKFLOW` resource, and which name will appear in the workflow service log when the work behind an approved request silently does not happen.

The definitions themselves are files read by the workflow service when it starts, so editing one — and getting the edit deployed — is deployment work rather than administration: see the [Installation Guide](/installation/installation.md). What you configure from the Webconsole is which approvers a flow resolves, and that is in [Approval flows](/administration-guide/requests/approval-flows.md).

{% hint style="warning" %}
Activiti keeps previously deployed process definitions and versions them, so a redeployed definition does not replace the old one. **In-flight requests continue on the version they started with.** Do not assume a corrected definition retroactively fixes requests that are already stuck — find them, and complete or cancel them deliberately. There is no screen that lists deployed definition versions, so if you need to know which version a stuck request is running, ask whoever owns the deployment.
{% endhint %}

## The approval loop

Most entitlement flows share one structure, clearest in `addUserToRole.bpmn20.xml`: a multi-instance sub-process that iterates over the resolved approver list, with a completion condition that exits the loop as soon as the request is rejected. The **Multi-instance approval loop** column below tells you which definitions have it. A flow without one consults exactly one approver, whatever the approver association resolves to.

Two variables drive the loop: `ApproverCardindality` — the approver list, and the spelling really is that, so match it exactly — and `IsTaskApproved`. See [Workflow variables](/administration-guide/reference/enums.md#workflow-variables) for the full list.

When a request is stuck, those two variable values are the first evidence to collect. You read them from the request's own detail screen in the Webconsole rather than from the definition; if they are absent there, the process never reached the loop.

## Definition inventory

All 49, with the file name, the process ID and whether the flow loops over multiple approvers. The **Process ID** is the value that matters to you: it is what an `ACTIVITI_REQUEST` or `WORKFLOW` resource names, and what a request type keys on, so it is the string to match when you are working out which flow a request actually started. The **User task** column is the task's own identifier inside the definition, which is what appears in the Activiti history tables rather than on screen — the label an approver sees in their inbox is set separately and is usually *Manual Task*.

| File                                       | Process ID                      | Multi-instance approval loop | User task             |
| ------------------------------------------ | ------------------------------- | ---------------------------- | --------------------- |
| `accessCertification.bpmn20.xml`           | `accessCertification`           | —                            | `makeRequestDecision` |
| `addGroup2Group.bpmn20.xml`                | `addGroup2Group`                | yes                          | `makeRequestDecision` |
| `addRole2Group.bpmn20.xml`                 | `addRole2Group`                 | yes                          | `makeRequestDecision` |
| `addRole2Role.bpmn20.xml`                  | `addRole2Role`                  | yes                          | `makeRequestDecision` |
| `addSuperior.bpmn20.xml`                   | `addSuperior`                   | —                            | `makeRequestDecision` |
| `addUserToGroup.bpmn20.xml`                | `addUserToGroup`                | yes                          | `makeRequestDecision` |
| `addUserToOrg.bpmn20.xml`                  | `addUserToOrganization`         | yes                          | `makeRequestDecision` |
| `addUserToRole.bpmn20.xml`                 | `addUserToRole`                 | yes                          | `makeRequestDecision` |
| `createPrivilegedAccessRequest.bpmn20.xml` | `createPrivilegedAccessRequest` | —                            | `makeRequestDecision` |
| `createUserRequestApprovers.bpmn20.xml`    | `createUserRequestApprovers`    | —                            | `makeRequestDecision` |
| `deleteGroup.bpmn20.xml`                   | `deleteGroup`                   | yes                          | `makeRequestDecision` |
| `deleteLogin.bpmn20.xml`                   | `deleteLogin`                   | —                            | `makeRequestDecision` |
| `deleteOrganization.bpmn20.xml`            | `deleteOrganization`            | yes                          | `makeRequestDecision` |
| `deleteResource.bpmn20.xml`                | `deleteResource`                | yes                          | `makeRequestDecision` |
| `deleteRole.bpmn20.xml`                    | `deleteRole`                    | yes                          | `makeRequestDecision` |
| `disentitleUserFromResource.bpmn20.xml`    | `disentitleUserFromResource`    | yes                          | `makeRequestDecision` |
| `editGroup.bpmn20.xml`                     | `editGroup`                     | yes                          | `makeRequestDecision` |
| `editOrganization.bpmn20.xml`              | `editOrganization`              | yes                          | `makeRequestDecision` |
| `editResource.bpmn20.xml`                  | `editResource`                  | yes                          | `makeRequestDecision` |
| `editRole.bpmn20.xml`                      | `editRole`                      | yes                          | `makeRequestDecision` |
| `editUser.bpmn20.xml`                      | `editUser`                      | yes                          | `makeRequestDecision` |
| `entitleResource2Group.bpmn20.xml`         | `addResource2Group`             | yes                          | `makeRequestDecision` |
| `entitleResource2Resource.bpmn20.xml`      | `addResource2Role`              | yes                          | `makeRequestDecision` |
| `entitleResource2Role.bpmn20.xml`          | `addResource2Resource`          | yes                          | `makeRequestDecision` |
| `entitleUserToResource.bpmn20.xml`         | `entitleUserToResource`         | yes                          | `makeRequestDecision` |
| `manualTask.bpmn20.xml`                    | `manualTask`                    | —                            | `makeRequestDecision` |
| `newGroup.bpmn20.xml`                      | `newGroup`                      | yes                          | `makeRequestDecision` |
| `newOrganization.bpmn20.xml`               | `newOrganization`               | yes                          | `makeRequestDecision` |
| `newResource.bpmn20.xml`                   | `newResource`                   | yes                          | `makeRequestDecision` |
| `newRole.bpmn20.xml`                       | `newRole`                       | yes                          | `makeRequestDecision` |
| `newhire.bpmn20.xml`                       | `newHireWithApprovalProcess`    | yes                          | `makeRequestDecision` |
| `newhire.noapproval.bpmn20.xml`            | `newHireWithNoApproval`         | —                            | —                     |
| `removeGroupFromGroup.bpmn20.xml`          | `removeGroupFromGroup`          | yes                          | `makeRequestDecision` |
| `removeResourceFromGroup.bpmn20.xml`       | `removeResourceFromGroup`       | yes                          | `makeRequestDecision` |
| `removeResourceFromResource.bpmn20.xml`    | `removeResourceFromResource`    | yes                          | `makeRequestDecision` |
| `removeResourceFromRole.bpmn20.xml`        | `removeResourceFromRole`        | yes                          | `makeRequestDecision` |
| `removeRoleFromGroup.bpmn20.xml`           | `removeRoleFromGroup`           | yes                          | `makeRequestDecision` |
| `removeRoleFromRole.bpmn20.xml`            | `removeRoleFromRole`            | yes                          | `makeRequestDecision` |
| `removeSuperior.bpmn20.xml`                | `removeSuperior`                | —                            | `makeRequestDecision` |
| `removeUserFromGroup.bpmn20.xml`           | `removeUserFromGroup`           | yes                          | `makeRequestDecision` |
| `removeUserFromOrg.bpmn20.xml`             | `removeUserFromOrganization`    | yes                          | `makeRequestDecision` |
| `removeUserFromRole.bpmn20.xml`            | `removeUserFromRole`            | yes                          | `makeRequestDecision` |
| `resourceCertification.bpmn20.xml`         | `resourceCertification`         | yes                          | `makeRequestDecision` |
| `reviewRevokeAllAccess.bpmn20.xml`         | `reviewAccessOnPositionChange`  | —                            | `makeRequestDecision` |
| `revokeAccess.bpmn20.xml`                  | `REVOKE_ACCESS`                 | yes                          | `makeRequestDecision` |
| `saveLogin.bpmn20.xml`                     | `saveLogin`                     | —                            | `makeRequestDecision` |
| `selfRegistration.bpmn20.xml`              | `selfRegistration`              | yes                          | `makeRequestDecision` |
| `terminateUser.bpmn20.xml`                 | `terminateUserProcess`          | —                            | `makeRequestDecision` |
| `userAcceptedInvite.bpmn20.xml`            | `userAcceptedInvite`            | yes                          | `makeRequestDecision` |

## Service-task delegates

A delegate is the unit of work a flow runs once a decision is made — it is what actually adds the role, sends the notification, or deletes the group. You will meet these names in two places: in the workflow service log, where a failure prints the delegate's name in the stack trace, and in the definition itself if you ever read one. Neither the Webconsole nor the request's own screen names them, which is exactly why they are listed here: when an approved request completes but the change never lands, the log line to search for carries the delegate name from this table, not the name of the flow.

The counts say how many of the 49 definitions use each one, so a delegate used by 39 definitions appearing in a stack trace tells you far less about which request failed than one used by a single definition.

| Delegate                                   | Used by        |
| ------------------------------------------ | -------------- |
| `AcceptEntitlementsNotifierDelegate`       | 37 definitions |
| `AcceptSupervisorNotifierDelegate`         | 2 definitions  |
| `AddSupervisor`                            | 1 definition   |
| `BasicEntitlementsRequestDelegate`         | 39 definitions |
| `CompleteManualTask`                       | 1 definition   |
| `DeleteGroupDelegate`                      | 1 definition   |
| `DeleteLogin`                              | 1 definition   |
| `DeleteOrganizationDelegate`               | 1 definition   |
| `DeleteResourceDelegate`                   | 1 definition   |
| `DeleteRoleDelegate`                       | 1 definition   |
| `EntityMembershipDelegate`                 | 22 definitions |
| `RejectEntitlementsNotifierDelegate`       | 37 definitions |
| `RejectSupervisorNotifierDelegate`         | 2 definitions  |
| `RemoveSupervisor`                         | 1 definition   |
| `SaveGroupDelegate`                        | 2 definitions  |
| `SaveLogin`                                | 1 definition   |
| `SaveOrganizationDelegate`                 | 2 definitions  |
| `SaveResourceDelegate`                     | 2 definitions  |
| `SaveRoleDeletage`                         | 2 definitions  |
| `UpdateManualTask`                         | 1 definition   |
| `GroupDisplayMapper`                       | 2 definitions  |
| `LoginDisplayMapper`                       | 1 definition   |
| `OrganizationDisplayMapper`                | 2 definitions  |
| `ResourceDisplayMapper`                    | 2 definitions  |
| `RoleDisplayMapper`                        | 2 definitions  |
| `AcceptAccessRequestNotifierDelegate`      | 1 definition   |
| `CreateAccessRequestDelegate`              | 1 definition   |
| `RejectAccessRequestNotifierDelegate`      | 2 definitions  |
| `RevokeAccessRequestDelegate`              | 1 definition   |
| `SendCreateAccessRequestDelegate`          | 2 definitions  |
| `SendRevokeAccessRequestDelegate`          | 1 definition   |
| `AccessCertificationDelegate`              | 1 definition   |
| `AccessCertificationRequestDelegate`       | 1 definition   |
| `CompleteUserAccessReviewNotifierDelegate` | 1 definition   |
| `AcceptAddUserViaInviteNotifierDelegate`   | 1 definition   |
| `AcceptEditUserNotifierDelegate`           | 1 definition   |
| `AcceptPrivilegedAccessRequestNotifier`    | 1 definition   |
| `AcceptTerminateUserNotifierDelegate`      | 1 definition   |
| `CreatePrivilegedAccessRequestDelegate`    | 1 definition   |
| `RejectAddUserViaInviteNotifierDelegate`   | 1 definition   |
| `RejectEditUserNotifierDelegate`           | 1 definition   |
| `RejectTerminateUserNotifierDelegate`      | 1 definition   |
| `SendEditUserRequestDelegate`              | 2 definitions  |
| `TerminateUser`                            | 1 definition   |
| `UpdateUserAfterInviteWorkflowDelegate`    | 1 definition   |
| `UpdateUserDelegate`                       | 1 definition   |
| `EditUserDisplayMapperDelegate`            | 2 definitions  |
| `AcceptProfileProvisionDelegate`           | 3 definitions  |
| `CreateNewUser`                            | 3 definitions  |
| `RejectProfileProvisionDelegate`           | 2 definitions  |
| `SendNewHireRequestDelegate`               | 2 definitions  |
| `NewUserDisplayMapperDelegate`             | 2 definitions  |

A log line prints the fully-qualified name; only the final segment is listed here, and matching on that segment is enough. Two names in this table are misspelled in the product — `SaveRoleDeletage`, and `ApproverCardindality` above — so search the log for the string as written here, not as it should be.

## Related

* [Approval flows](/administration-guide/requests/approval-flows.md) — approver associations, the properties that route them, and how a flow resolves its approvers
* [Fulfilment](/administration-guide/requests/fulfilment.md) — `manualTask` in context with the other 48 definitions
* [Workflow variables](/administration-guide/reference/enums.md#workflow-variables) — every variable a flow reads or sets
* [Object model](/administration-guide/start/object-model.md) — the `WORKFLOW` and `ACTIVITI_REQUEST` resource types that make a definition an authorization target

*Applies to OpenIAM 2026.8.1. Last reviewed 7 August 2026.*


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.openiam.com/administration-guide/reference/shipped-workflows.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.