How approvals work, including the one-click email links

The approval flow is shared by leave and claims. Its design goal is narrow: make approving something take under ten seconds, because approval latency is what makes staff dislike HR systems.

Who approves what

Each employee has one or more approvers, set explicitly. One can be marked primary. If no approver is set, routing falls back to the reporting line. For claims there is an additional delegation mechanism: an approver can be designated to handle a whole department or seniority level, which is how a finance manager ends up approving expenses across teams they do not manage.

Approvers see a queue of pending requests scoped to the people they are responsible for. Admins see everything for their company. Super admins can override a decision, and doing so is flagged on the record and written to the audit log — an override is visible, not silent.

The one-click links

When a request is submitted, each approver gets an email containing the details and two buttons: approve and reject. Clicking one opens a confirmation page and completes the decision. No login.

Here is what protects that link:

• It is bound to one approver and one request. The token identifies both. It cannot be used to act on anything else.
• It is single-use. The token is marked consumed on use. A forwarded email cannot replay the decision.
• It expires. Tokens have a fixed lifetime; an old email in an archive is not a live credential.
• It requires confirmation. The link opens a page showing the request and asks for a click, so an email client prefetching URLs cannot approve anything by accident.

What happens on approval

1. 1The status changes, and the reviewer, timestamp and any comment are recorded.
2. 2For leave, the used-days figure on the entitlement increases by the application's day count.
3. 3For a benefit-backed claim, the used amount for the current benefit period increases.
4. 4The requester is notified.
5. 5An audit entry is written.

Cancellation reverses the balance effects. An employee can cancel their own pending request; cancelling an already-approved one returns the days or the amount.

Notification delivery

Emails are not sent inline with the request. They are written to an outbox table and delivered by a scheduled worker with retries and backoff. If your mail provider has a bad five minutes, the approval email is delayed, not lost. Failed messages stay visible with their error rather than disappearing.