Request Approval

A Request Approval rule holds outgoing email until one or more reviewers approve it. Use it when certain emails need a second pair of eyes before they leave, for example contracts sent to clients, files sent to a regulator, or anything a new employee sends outside during probation. This page covers approval steps, reviewers, expiration, reminders, notifications and what reviewers see.

Note: Older documents call this action Supervisor Approval.

Before you begin

• Your outbound mail is routed through mxHERO. See Routing Architectures.
• Senders and reviewers are accounts in Settings › Accounts and Groups. To use groups or tags as reviewers, set them up first. See Groups and Managing Accounts.
• Reviewers can sign in to the End User App (https://app.mxhero.com). Check the sign-in options in Settings › Security › mxHERO End User Application. See Security Settings.
• Agree on a response time with reviewers. Emails nobody approves before the expiration are not delivered.

How it works

An approval request moves through its steps in order; any rejection, cancellation or expiry stops delivery.

1. A user in your organization sends an email that matches the rule.
2. mxHERO holds the email once for all its recipients and creates one approval request.
3. The reviewers of step 1 are notified. One approval from a step's reviewers moves the request to the next step.
4. After the last step approves, the email is delivered to all recipients.
5. The email is not delivered if any reviewer rejects it, the sender cancels it, or the request expires.

A sender can never approve their own email, even if they are a reviewer in one of the steps.

Request Approval rules run only on email sent by your organization's users. Incoming email can't be held for approval. They run after S/MIME, Block Attachments and Temporary Hold, and before Copy Emails and the storage actions. See How Rules Work.

Create a Request Approval rule

The Target step comes first.

Step 1: Target

1. Open Rules › Create a Rule, click Request Approval, then Start Rule Creation.

2. Under Rule Scope:, click Email Flow (the only choice).

3. Under Target all emails sent:, the first field is fixed to From. Choose the Sender (default Organization) and the Recipient (default Anyone).

   

   The Sender must be your own users: Organization, one of your domains, a group, a tag or addresses. Anyone and Anyone else are not accepted as the sender.

   Examples:

   Goal	Sender	Recipient
   Review everything the sales team sends outside	group Sales	Anyone else
   Review email to a regulator	Organization	regulator.example
   Review new hires' external email	tag probation	Anyone else

4. Optionally open Advanced Options:

   • Include From, To and CC when evaluating which emails will be processed. On by default. The rule also matches addresses in the From, To and Cc headers, so an email is held when any visible recipient matches.
   • Include From header when evaluating which emails will be processed. Not available while the option above is on.

5. Click Confirm.

Add Filters: Target Filters (optional)

Click Add Filters under the Target step:

• Use filter policy: request approval only when the selected filter policy matches, for example when the subject or attachment names contain "contract". See Filter Policies.
• Sender/Recipient (From/To) Exclusions: address pairs the rule skips. Click Add another exclusion for more pairs.

When you turn on exclusions, an Exclusion matching option appears below the list:

For example, to skip approval for email to your auditors only when the auditors are the only recipients, add an exclusion Organization to auditor.example and choose all recipients. An email to an auditor and a client then still needs approval.

#nomxhero in the subject does not skip a Request Approval rule. See Filters and Exclusions.

Step 2: Approval Steps

1. Under Reviewers, in step 1, click Search accounts, groups, tags or variables and type part of a name. Pick a result. Results are grouped by type:

   Reviewer type	Who can approve the step
   User account	That person.
   Group	Any member of the group.
   Tag	Any account with that tag ("At least one recipient associated with this tag must review and approve the delivery.").
   Variable	The address the variable produces for this email, for example a custom variable that looks up the sender's manager in a dataset. See Custom Variables.

   

   

2. To require another approval after the first, click + Add a new step and choose its reviewer. Remove a step with its trash icon.

3. Click Confirm.

Each step has one reviewer entry: a person, group, tag or variable. Use a group or tag when several people can approve the same step. You can add up to 10 steps, and every step must have a reviewer.

Important: Steps run one after the other. Two steps means two separate approvals, not "either of two people". For "either person", use one step with a group or tag.

Step 2 Advanced Options

Open Advanced Options in the Approval Steps step.

Approval Expiration: "When the specified time expires without approval, the request is canceled, and a notification is sent to the sender."

Enter durations longer than 24 hours in Days. An expired request is not delivered.

The notification options are described in Notifications.

Add attachment filter (optional)

Click Add attachment filter to require approval only for emails with certain attachments, for example .xlsx files or anything over 10 MB.

Note: Adding this panel restricts the rule to emails with attachments. Only emails carrying at least one attachment that matches the conditions need approval. Emails without attachments are never held by this rule.

The filters and their behavior are the same as for Temporary Hold. See Temporary Hold (Add attachment filter). Turn on Include TNEF messages if Outlook/Exchange winmail.dat messages must also be approved; otherwise they are never held. See Preventing TNEF Encapsulation.

Name and save

1. In the right column, enter a Rule Name and optionally a Rule Description.
2. Set Locale if your users' language differs from the organization's. Default notification texts follow it.
3. Click Save Rule. The rule is enabled at once and applies within one to two minutes.

Notifications

Configure notifications under Advanced Options in the Approval Steps step. In body fields, type { to insert placeholders.

Enable Supervisor Notifications (on): sent to the reviewers of each step.

Important: Turn on Supervisor access link. Without it, reviewers can approve from the email without seeing what they approve, unless they open the End User App themselves.

Enable Sender Notifications (on): sent to the sender when the request is created.

Enable Reminder Sender Notifications (off): periodic reminders to the sender while the request is pending.

• Reminder Interval: Duration + Unit. The dashboard shows the shortest interval allowed and how many reminders the current setting sends, for example "For an expiration of 7 days, minimum reminder interval is 12 hours. Current configuration will send approximately 1 reminder notifications."
• Reminder notification title (Approval Still Pending - Action Required), Reminder notification body text, and optional access and cancel links.

The interval can't be longer than the expiration. Its minimum depends on the expiration: 2 hours (under 24 hours), 6 hours (24–72 hours), 12 hours (72 hours to 7 days), 48 hours (over 7 days). The default interval equals the expiration, which sends about one reminder; shorten it if you want more.

Enable Completion Notifications (on): sent to the sender when the request ends.

Limits: titles 115 characters, subjects 150, link labels 54, bodies 1,500. See Notification Templates.

Reviewers aren't sent reminders by this option; the reminders go to the sender.

What reviewers and senders do

• Reviewers approve or reject from the APPROVE / REJECT buttons in the email, or in the End User App, Request Approval section, where they can see the recipients and attachments and download the email as .eml. A rejection can include a reason.
• Senders follow their requests in the End User App and can cancel them with CANCEL.
• When a step's reviewer is a group or tag, the first member to decide decides for everyone. Clicking a link after that shows the current status, for example "already approved" or "expired".

The full user guide is Approving Emails.

Approval groups, history and admin view

• Approval groups. In Settings › Accounts and Groups, the Approval groups field of an account lets the members of those groups act on that account's approval items in the End User App, for example a team that covers for an absent manager. You can also set it with the CSV bulk import. See Managing Accounts.
• History visibility. Settings › Security › Request approval permissions › Message visibility controls the history users see: Team (default; current and past requests from the user or their team), Personal only (only their own history), or Acted on (only history they acted on). Current requests stay visible in all three. Use Personal only or Acted on when people who join a group later must not see its older approvals. See Security Settings.
• History range. Users choose a sent-date range: 7 days by default, up to 30 days at a time, up to one year back.
• Admin view. Owners, and Administrators with the Request Approval admin-view permission, can see and act on all requests in the End User App. Their actions are recorded as admin actions. See Users and Roles.

Verify

1. Create the rule with one pilot sender (Sender = that address) and yourself as the step 1 reviewer. Turn on Supervisor access link.
2. From the pilot sender, send a test email to an external mailbox you control.
3. Check that the recipient gets nothing, the sender gets the request notice and you get the approval email.
4. In Reports › Email Flow Logs, the email shows Retained Emails. See Email Flow Logs.
5. Click APPROVE. The email is delivered and the sender gets the completion notice.
6. Repeat with REJECT, and with CANCEL from the sender. In both cases the log shows Dropped by rule action.

Limits and failure behavior

• Email Flow only, and only email sent by your organization's users.
• One request per email for all recipients. You can't approve some recipients and reject others.
• Up to 10 steps. Expiration up to 30 days; enter anything longer than 24 hours in Days.
• If mxHERO can't hold the email (for example, it can't store it), the rule fails open: the email is delivered without approval and the error appears in Email Flow Logs and Reports › Notifications (execution_failed). If approval is a hard compliance requirement, monitor these notifications. See Notification Error Codes.
• Held email is stored by mxHERO until it is released or discarded.

Troubleshooting

Related pages

• Approving Emails (end users)
• Temporary Hold
• Create a Rule
• Filters and Exclusions
• Groups
• Notification Templates
• Security Settings