Skip to content
allanninal.dev/build
Collaborate

Part 4 of 7 · Purchase order approver series ~6 min read

How an approval reaches the right person

A request that fails no check but sits above the auto-approve line has to reach a person, and reaching a person is where most approval systems quietly fail. They send a notification that is really a form, to a queue nobody opens, and three days later somebody buys the thing on a personal card anyway. This post is about making the ask small enough to answer at a set of traffic lights, and loud enough that silence is not an option.

Key takeaways

  • The approver comes from the budget line in the sheet, not from a reporting hierarchy.
  • The message leads with the consequence: what this line has left after saying yes.
  • Two buttons and a question box. No form, no login, nothing to open on a laptop.
  • Approve links are single-use and expire. A forwarded email cannot approve anything.
  • Silence escalates on a schedule — a nudge, then a second approver, then the requester is told.

Who gets asked

The obvious answer is “their manager”, and the obvious answer is wrong. The person who should decide is the person who owns the budget the money comes out of, and in a small business those two are often different people. The workshop lead reports to operations; the workshop consumables budget belongs to the owner. So the approver is a column in the sheet, next to the limit, and changing who approves what is an edit in a spreadsheet.

How an approval request reaches the person who owns the budgetThree boxes across the top, outside the AWS account. The Budget sheet, which carries the budget line, its limit and the name of the person who approves against it. The Approver, who is usually reading on a phone. And the Requester, who is kept in the loop either way. Inside the AWS account, three components. The Message builder, which composes one screen with one number that matters. Send and sign, which mints single-use links and sends through Amazon SES. And the Escalator, which nudges, then tries a second approver, then tells the requester. Arrows show the sheet feeding in to say who owns the line, the approver sending back an approve or decline, and the requester receiving status either way. A note says nothing here needs a login, an app or a laptop, which is the entire point.AWS ACCOUNTBudget sheetline, limit, approverApproveron a phone, usuallyRequesterkept in the loopMessage builderone screen,one number that mattersSend and signsingle-use links,SES outEscalatornudge, second approver,tell the requesterwho owns this lineapprove or declinestatus, either wayNothing here needs a login, an app, or a laptop -- which is the entire point.
Fig 1. Getting the decision to the person who owns the money. The sheet says who that is, the message builder makes the ask answerable on a phone, and the escalator makes sure silence does not become a decision by default.
  • App integration
  • Management
  • Analytics
  • People

What the message says

Most approval emails are a summary of the request. This one is a summary of the consequence. The difference is one line, and it is the difference between a decision and a guess.

The whole message, in order

  • Line one. Who wants what, for how much. “Dana wants a replacement bench grinder from Medline, $640.”
  • Line two. The number that decides it. “Workshop consumables has $1,150 left this quarter. This would leave $510.”
  • Line three. Anything unusual, or nothing. “Medline: 6 orders this year, all fine.” Or: “New vendor — approving this adds them to the list.”
  • Two buttons. Approve. Decline. Both single-use, both expiring in 72 hours.
  • One box. “Ask Dana something” — a reply that goes back to the requester and keeps the request open.
  • The attachment, if there was one. The quote PDF, the screenshot of the cart. One tap, no download.

That is the whole message. There is no line-item table, no request id in the subject, no “click here to view in the portal”. A portal is a place you have to go; this has to work in the ninety seconds somebody has between two other things.

The approve button is a URL, which means it is a bearer token, which means anybody holding it can spend money. Three rules keep that honest, and none of them requires the approver to log in to anything.

  • Signed and scoped. The link carries the request id and an HMAC over it, signed with a key from Secrets Manager. It is valid for that one request and nothing else. A tampered id fails the signature and is discarded without a database read.
  • Single-use. The first click writes the decision with a condition that the request is still pending. A second click — a forwarded email, a double tap, a link preview fetching the URL — finds it already decided and shows the decision instead of making a new one.
  • Short-lived. 72 hours. After that the link is dead and the request has escalated anyway. An approval link found in an old inbox in six months is worth nothing.

It is worth being blunt about the trade-off: a signed link in an email is weaker than a login. What it buys is that the decision actually gets made, on a phone, in a minute, instead of waiting for somebody to be at a desk. For purchase amounts in the hundreds against a budget line with a hard ceiling, that trade is a good one. For amounts where it is not, the sheet has a second threshold above which the link only opens a page that requires a real sign-in.

What happens when nobody answers

Silence is the failure mode that matters, because silence looks exactly like a system that is working. So an unanswered request is a scheduled event, not a row that ages.

What happens to an approval request that nobody answersA vertical chain of five steps. First, Sent and waiting, with a timer set for twenty-four hours. Second, at twenty-four hours, still waiting, which exits to Nudge the approver with the same message written shorter. Third, at forty-eight hours, still waiting, which brings in the second approver named in the budget sheet and exits to Ask them instead, with the first approver copied in. Fourth, at seventy-two hours, still waiting, which exits to Tell the requester, including who to chase. Fifth, Decided, logged with who decided and when. A note says a request never expires; it gets louder until a person owns it.AWS ACCOUNTSent, waitingtimer set for 24hStill waiting?at 24 hoursNudge the approversame message, shorteryesStill waiting?at 48 hoursSecond approverfrom the sheetAsk them insteadfirst one CC'dyesStill waiting?at 72 hoursTell the requesterwith who to chaseyesDecidedlogged with who and whenA request never expires. It gets louder until a person owns it.
Fig 2. The escalation ladder. Twenty-four hours buys a nudge, forty-eight brings in the second approver named in the sheet, and seventy-two tells the requester who to go and find.
  • App integration
  • Machine learning
  • Management
  • People

Next: what actually happens the moment somebody taps approve — the purchase order, the ledger write, and the one ordering problem that makes this harder than it looks.

All posts