# Access Request on Behalf Template

## Use Case Overview

This workflow enables a person to request access for another individual, e.g.

* managers can request access to specific areas for their employees. 
* contractor's manager within the company to request necessary access for contractors, etc.  

Requests are routed to the relevant approvers. As with all requests in AccessNow, cardholders for whom access is requested must already exist in the Command Centre.

## Prerequisites configuration 

Before configuring this template, ensure the required system entities, such as lists or approver groups, are already set up. This includes pre-configuring the following elements:

{% stepper %}
{% step %}

### [Command Centre Access Group List](/command-centre/accessnow-user-guide/workflow-creation/creating-and-managing-workflows/workflow-configuration/lists/command-centre-access-group-list.md) 

Import the Access Group list from the Command Centre and configure it with the desired areas available for requests.
{% endstep %}

{% step %}

### [Approver Groups](/command-centre/accessnow-user-guide/workflow-creation/creating-and-managing-workflows/workflow-configuration/approver-groups.md) 

Approver Groups are collections of individuals who review requests and make approval or denial decisions. They must be preconfigured for use in a workflow. While different Approver Groups may be assigned to each Access Group. It is advisable to establish a Default Approver Group to act as a fallback when no Approver Group is assigned to an access group.
{% endstep %}

{% step %}

### [Access Groups & Approver Groups linking](/command-centre/accessnow-user-guide/workflow-creation/creating-and-managing-workflows/workflow-configuration/lists/command-centre-access-group-list/assigning-approvers-to-access-groups.md)  

Each Command Centre Access Group has an assigned approver group. This ensures that each area is approved by the responsible individuals. Configure the assignment of approver groups to the access groups accordingly.
{% endstep %}

{% step %}

### [Notification Email Templates](/command-centre/accessnow-user-guide/workflow-creation/creating-and-managing-workflows/workflow-configuration/email-templates.md)

The workflow automatically sends notification emails at configured points, such as notifying approvers when an approval task is created or informing a requester when a request is completed. Email templates for these notifications should be predefined. Some templates are specific to a workflow, while others are versatile. The emails utilize variables to personalize the content, ensuring tailored messages.  
{% endstep %}

{% step %}

### [Create new workflow ](/command-centre/accessnow-user-guide/workflow-creation/creating-and-managing-workflows/workflow-management/creating-a-new-workflow.md) 

To create a workflow from a template, first manually create an empty workflow.
{% endstep %}

{% step %}

### [Import a template ](/command-centre/accessnow-user-guide/workflow-creation/creating-and-managing-workflows/working-with-workflow-templates/importing-workflows.md)

Download the template you want to customize and import it into the empty workflow created earlier. After that, you can start customizing your template.

Once the workflow is imported, steps and fields needing configuration are highlighted in red and are also mentioned in the validation messages. Follow the instructions below to configure these steps. 

<figure><img src="/files/zWAW6w6IZSaV4YW7UF6b" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### Step configuration: *Data Initialisation*  &#x20;

Open the workflow in the [edit mode](/command-centre/accessnow-user-guide/workflow-creation/creating-and-managing-workflows/workflow-management/editing-a-workflow-version.md) and find the [Data Initialisation step](/command-centre/accessnow-user-guide/workflow-creation/creating-and-managing-workflows/workflow-configuration/steps/data-initialisation-step.md). This step, aims to configure all necessary fields and values required for the workflow before executing the process.&#x20;

{% hint style="info" %}
Data Initialisation step is where you link the workflow template to the prerequisite elements you configured in the previous steps. Learn more about the [Data Initialisation step configuration](/command-centre/accessnow-user-guide/workflow-creation/creating-and-managing-workflows/workflow-configuration/steps/data-initialisation-step.md).&#x20;
{% endhint %}

<div data-with-frame="true"><figure><img src="/files/DXs2N268NkpSmYIk1iPp" alt="" width="300"><figcaption></figcaption></figure></div>

#### Data Setup tab&#x20;

**Click** on the step. It displays the step's configuration in the side panel.&#x20;

Find the step's **Data Setup** **tab**. Steps and fields needing configuration are highlighted in red and are also mentioned in the validation message. Follow the instructions in the table below to configure the required fields.

Remember to **Save** your changes.&#x20;

{% hint style="warning" %}
To learn how to reference the **Command Centre PDF IDs** in AccessNow, follow these instructions: [Command Centre PDF IDs](/command-centre/accessnow-user-guide/help-resources/command-centre-pdf-and-card-type-ids.md)
{% endhint %}

<table><thead><tr><th>Field Name</th><th width="131.748779296875">Value Type</th><th>Value</th></tr></thead><tbody><tr><td>AreaAccessList</td><td>List</td><td>Select the list containing the imported Command Centre Access Groups.</td></tr><tr><td>DefaultApproverGroups </td><td>Group</td><td>Choose the default approver groups for this type of request.</td></tr><tr><td>UniqueUserPdfForRequester </td><td>String</td><td>Please provide the <a href="/pages/Q8ZBe78gUpYN1tmHXtbV">Command Centre PDF ID</a> that uniquely identifies the <strong>cardholder who is making the request</strong>.</td></tr><tr><td>UniqueUserPdfForRecipient</td><td>String</td><td>Please provide the <a href="/pages/Q8ZBe78gUpYN1tmHXtbV">Command Centre PDF ID</a> that uniquely identifies the <strong>cardholder for whom access is requested.</strong></td></tr><tr><td>ReadPDFsFromCC</td><td>String</td><td>Find the  <code>pdf_xxx</code> strings and replace them with the  <a href="/pages/Q8ZBe78gUpYN1tmHXtbV">Command Centre PDF ID</a> that references the cardholder information visible to the approvers, such as Department, Phone, Role, etc.</td></tr><tr><td>NotifyApproverEmail</td><td>Email Template</td><td>Select the notification email template to send to an Approver Group when a request for approval is created.</td></tr><tr><td>RequestCreatedEmailForRecipient </td><td>Email Template</td><td>Select the notification template to inform the access recipient about the request creation.</td></tr><tr><td>RequestCompletedEmailForRecipient</td><td>Email Template</td><td>Choose the notification email template to send to the access recipient when a request is completed.</td></tr><tr><td>RequestCompletedEmailForRequester</td><td>Email Template</td><td>Choose the notification email template to send to the requester when a request is completed.</td></tr><tr><td>RequestFailedEmailForRequester</td><td>Email Template</td><td>Select the email template for notifying the requester when a request fails due to a system error.</td></tr><tr><td>RequestFailedEmailForApprover</td><td>Email Template</td><td>Select the email template for notifying the approver when access provisioning fails due to a system error.</td></tr><tr><td>RequestRejectedEmail</td><td>Email Template</td><td>Choose the notification email template to send to the requester when a request is rejected by the approvers.</td></tr><tr><td>RequestExternalRef</td><td>String</td><td><strong>DO NOT REMOVE!</strong> <br>Leave as is: {Request.ExternalRef}</td></tr></tbody></table>
{% endstep %}

{% step %}

### Step configuration: *New Access Request on Behalf*

The purpose of this step is to gather request details from the requester using a preconfigured input form. While the form is already preconfigured, the data source for the AccessGroup list still needs to be configured.

{% hint style="info" %}
Learn more about the [Input Step configuration](/command-centre/accessnow-user-guide/workflow-creation/creating-and-managing-workflows/workflow-configuration/steps/input-step.md).&#x20;
{% endhint %}

<div data-with-frame="true"><figure><img src="/files/JaNw0wiVlxSYLfBy2Tet" alt="" width="315"><figcaption></figcaption></figure></div>

#### Form Fields tab > Areas they require access to > Data Source

**Click** on the step. It displays the step's configuration in the side panel.&#x20;

Locate the step's **Form** **Fields** **tab**.&#x20;

Find the filed named **Areas they require access to**.  &#x20;

Select the **Data Source** section. Open the **List Reference** drop-down. Choose the list of the Access Groups imported from the Command Centre. This is the list of access groups available for request.

Remember to **Save** your changes.&#x20;

<div data-with-frame="true"><figure><img src="/files/b2liFwAAtq2i3uGyCpo4" alt="" width="555"><figcaption></figcaption></figure></div>
{% endstep %}

{% step %}

### Step configuration: *Find Requester in Command Centre*

This step locates the requester cardholder record in Command Center using the unique ID (*UniqueUserPdfForRequester*) provided during the *Data Initialization* step. It can also be used to retrieve additional cardholder information, such as *Department*, *Phone*, *Role*, *Date of Birth*, etc., if available in the Command Center. The template allows for use of up to four PDFs. This information is then displayed to the approver.

{% hint style="info" %}
Learn more about the [Process Step configuration](/command-centre/accessnow-user-guide/workflow-creation/creating-and-managing-workflows/workflow-configuration/steps/process-step.md).
{% endhint %}

<div data-with-frame="true"><figure><img src="/files/JQ7m3yg7Ma6J2vAdQZZN" alt="" width="277"><figcaption></figcaption></figure></div>

#### Process tab > Output Map parameters&#x20;

**Click** on the step. It displays the step's configuration in the side panel.&#x20;

Locate the step's **Process** **tab** **>** **Output Map**&#x20;

In the Data Initialisation step, while setting the value of *ReadPDFsFromCC*, you identified the Personal Data fields (PDFs) for lookup in the Command Centre and to be displayed in AccessNow. This process step facilitates that task.&#x20;

However, it is essential to configure the **labels** of the Command Centre PDFs. These are the **expected Command Centre label names** and should be specified in the Process tab under the **Output Map** as parameters (see the below screen-shot).&#x20;

Output Map fields **before configuration**:&#x20;

<div data-with-frame="true"><figure><img src="/files/GEbB0TXabOwj8un1f8gj" alt="" width="563"><figcaption></figcaption></figure></div>

Output Map fields **after configuration**. Note in this example, we choose to delete two fields that were not used. **Save** your changes.&#x20;

<div data-with-frame="true"><figure><img src="/files/p8ulfXULfmTEisytCApy" alt="" width="563"><figcaption></figcaption></figure></div>

&#x20;
{% endstep %}

{% step %}

### *Step configuration: Find OnBehalf User in Command Centre*

The configuration of this step is identical to the previous step, *Find Requester in Command Centre*. This step is designed to extract Recipient information from Command Centre and display it to the approver.&#x20;

Locate the step's **Process** **tab** **>** **Output Map** and **follow the instructions from the previous step** to configure the Recipient's Output Map fields.

Remember to **Save** your changes.&#x20;

{% hint style="info" %}
Note: The workflow returns to the *New Access Request on Behalf* step if the access recipient is not found in the Command Centre. In this case, the requester must enter the recipient's details again.
{% endhint %}

<div data-with-frame="true"><figure><img src="/files/RbdhURuyP2iuVjALAW0c" alt="" width="315"><figcaption></figcaption></figure></div>

{% endstep %}

{% step %}

### Step configuration: *Approval for Access Request*&#x20;

This step creates an approval task for the relevant approver group.

{% hint style="info" %}
You can learn more about this type of step in the [Process Task Step section](/command-centre/accessnow-user-guide/workflow-creation/creating-and-managing-workflows/workflow-configuration/steps/process-task-step.md)
{% endhint %}

<div data-with-frame="true"><figure><img src="/files/Wnb6Xh1bpVe9y6pP51Dn" alt="" width="305"><figcaption></figcaption></figure></div>

#### Input Fields tab > Requester Details&#x20;

It is recommended to update the labels on the displayed Command Centre PDF information, even though configuring the Input Fields tab does not trigger a validation error. The **Requester details** form field uses the *UserCard* that displays the user information as shown in the example below.

<div data-with-frame="true"><figure><img src="/files/ppWYq0pnhRRQ9ONpxN31" alt="" width="563"><figcaption></figcaption></figure></div>

Go to **Input Fields > Requester Details > UserCard Details**

The UserCard is an interface element designed to display user details. Its configuration includes definitions for the data to be displayed, such as **First Name** and **Last Name**, which are selected and configured by default.

You can configure three additional fields labeled as **Pdf\_1**, **Pdf\_2**, and **Pdf\_3** as shown in the screenshot below.&#x20;

These fields need to be configured based on how many you want to display and what information you wish to extract from Command Centre as declared in the [*Data Initialisation*](#step-configuration-data-initialisation) and than in [*Find Requester in Command Centre*](#step-configuration-find-requester-in-command-centre) *and* [*Find OnBehalf User in Command Centre*](#step-configuration-find-onbehalf-user-in-command-centre)*.*&#x20;

<div data-with-frame="true"><figure><img src="/files/9nYQmLF7Iwmtry8tIfgG" alt="" width="563"><figcaption></figcaption></figure></div>

In our example, we've chosen to retrieve **Role** and **Department** details from the Command Centre for both the Requester and Recipient.&#x20;

To ensure that the labels in the UserCard align with the Command Centre information, **untick** the fields you are not using and **update the field labels** as shown in the screenshot below. **Save** your changes.&#x20;

<div data-with-frame="true"><figure><img src="/files/D3K8HUb6BzeTfU5sbk04" alt="" width="529"><figcaption></figcaption></figure></div>

#### Input Fields tab > Recipient Details &#x20;

Repeat the same steps for the **Input** **Fields tab > Recipient Details** > **UserCard Details** form field. Remember to **Save** your changes.&#x20;

#### Email tab > Contact Email Template&#x20;

Requesters can contact the approver group by clicking the **Contact our team** link (highlighted in the screenshot). It allows users to type a custom message and send it to the approval team.The additional custom configuration required for that step involves an email template used for sending emails to the approvers.

<figure><img src="/files/jzfsJxEdkW1gkxcS7B68" alt=""><figcaption></figcaption></figure>

To configure the email template, navigate to the **Email** **tab**. From the **Contact Email Template** dropdown, select the desired email template to be used when a requester contacts.&#x20;

Remember to **Save** your changes.&#x20;

<div data-with-frame="true"><figure><img src="/files/TULvtjEe6I4OLpImBEwt" alt="" width="329"><figcaption></figcaption></figure></div>
{% endstep %}

{% step %}

### [Test the workflow ](/command-centre/accessnow-user-guide/workflow-creation/creating-and-managing-workflows/workflow-management/testing-a-workflow-version.md)

It is recommended to test the workflow before publishing it for use by the system's end users.
{% endstep %}

{% step %}

### [Publish the workflow](/command-centre/accessnow-user-guide/workflow-creation/creating-and-managing-workflows/workflow-management/publishing-a-workflow-version.md)

After testing and being satisfied with the results, publish the workflow to make it available for system users to make requests.
{% endstep %}
{% endstepper %}

{% hint style="info" %}

### *Parent Complete* Workflow Branch&#x20;

When a user requests access to multiple areas, the system creates a parent request and separate child requests for each area. The parent request is not shown in the user interface, but the child requests are visible as individual Approval Tasks.&#x20;

The **Parent Complete** branch ensures that once all child requests are completed, the parent request is also marked as complete in the backend. The Parent Complete action is configured in the **Approval** step.&#x20;

When all of the child requests reach completion, the parent complete action triggers the parent request to move to the end process step, marking the entire request as finished.
{% endhint %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://help.security.gallagher.com/command-centre/accessnow-user-guide/workflow-creation/creating-and-managing-workflows/working-with-workflow-templates/access-request-on-behalf-template.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.