AWRA Help Center

Change Reviews

A change review holds a sensitive change until someone else approves it. It is off by default, and each kind of change is switched on separately under Settings → Change Reviews → Settings (needs manage security). The changes you can guard:

• Security policy downgrades — loosening multi-factor, session, password, single sign-on, lockout, IP or device rules. Step-up verification and the anomaly rules count too: taking an action off the step-up list, letting a step-up last longer, raising an anomaly threshold or switching a rule off. Tightening a rule applies at once; only loosening waits.
• Creating an API key and rotating an API key. Once approved, the new secret can be revealed once.
• Tax settings, inventory defaults and approval rules.
• Deleting the organization.

Requests wait in Settings → Change Reviews, on the web, in the API and in the mobile app.

1. The person making the change gives a reason. The change is held as a request carrying that reason and a snapshot of the setting as it was, instead of being applied.
2. A different active member with the review sensitive changes permission approves or rejects it. Approving applies the change exactly as requested.
3. A request nobody decides on expires after 72 hours.
4. If nobody else in the workspace can approve, the requester may approve their own request after 24 hours. It is recorded as self-approved, so the exception is visible rather than hidden.

Switching a guard off is itself held while any guard is on, so the protection cannot be removed by the person it is meant to check.

Rejecting a request needs a comment. Expiry is checked every hour, and each expired request is written to the audit log.

AWRA’s Own Owner-Console Actions

Three things AWRA staff can do from the owner console go through the same engine: signing in as a workspace or one of its users for support, allowing or denying a permission outside a workspace’s plan, and scheduling a workspace for deletion. Each can be held for a second AWRA system owner. An approved sign-in is a go-ahead for the person who asked, valid for an hour and never performed from the approver’s session; one that goes unused expires.

This is a deployment setting, not a switch under Settings → Change Reviews, and it covers only the actions the deployment names, none by default. On a dedicated instance it can be switched on for all three; on the shared service, ask us how it is set.

Delegated Admins

Settings → Delegated Admins (needs manage delegated admins) gives someone a limited administrator role of one of five types:

• Branch / warehouse admin — for the warehouses you name.
• Department admin — for the departments you name.
• Finance admin, Security admin and Implementation partner.

Granting one needs a note explaining why, and can carry an expiry date, which suits an implementation partner. A person has one delegation at a time; a new one replaces the old.

• A delegate manages only the people inside their scope, and cannot manage Admins or themselves.
• They can grant only permissions their type allows and that they hold themselves.
• They can edit a role only if everyone who holds it is inside their scope, so a branch admin cannot change a role the whole company shares.
• Delegations can be listed and revoked from the API as well as the web.

Role Impact Preview

Before you save a role, the preview shows what the change does to the people who hold it:

• Permissions added and removed, and any your plan withholds.
• Menus that appear or disappear.
• API routes that open or close, and mobile app screens that open or close.
• New segregation-of-duties conflicts the change creates, such as raising a purchase order and approving it.
• How many people hold the role.

It needs the add roles or edit roles permission, and works the same from the API.

Related: Admin Command Center, Roles and Enterprise SSO & SCIM.