When the named approver is away, a pre-named deputy of equal or higher authority approves, and the tool records that it was a delegated decision. Route requests to a role, not a person, add an escalation timer, and never let the requester pick their own cover.
Why this fails in practice
Most exception workflows are built around a name: "send it to Priya." Then Priya takes two weeks off. The request sits, a release slips, and someone asks a friendly colleague to approve it instead. That colleague has no authority, no context and no record of the delegation.
The result is either a stalled queue or an approval nobody can defend. Both show up in audits as the same finding: the approval did not come from someone authorised to give it.
The four pieces of a working cover plan
Route to a role. Point the workflow at "security approver" or "engineering director for payments", and resolve the role to people at the moment of request. Role membership changes in one place.
Name a deputy for each role. A deputy has the same decision rights for a stated period. Write down who can nominate deputies and where that list lives.
Record delegation as an event. The exception record should say "approved by Sam, acting for Priya, 3 to 14 November". Without that, a reviewer cannot tell a valid delegation from a workaround.
Escalate on a timer. If no one acts within the agreed window, the request moves up one level. It should never auto-approve.
Decision table
| Situation | Who decides | What to record |
|---|---|---|
| Approver on planned leave | Named deputy | Delegation start and end |
| Approver unreachable, urgent fix blocked | Next level up | Reason, time of escalation |
| Approver left the company | Role owner reassigns | New owner, date |
| Requester is the approver | A different approver, always | Conflict noted |
Guardrails that keep delegation honest
Cap delegation by severity. A deputy might approve medium findings, while critical ones go straight to the next level up. Make delegation expire on its own, so a leave-cover arrangement does not become permanent authority.
Keep a minimum of two people per role. If there is only one approver, you do not have a control, you have a single point of failure.
GitHub's own documentation for delegated alert dismissal carries a relevant warning: an approval step can create friction, so the team of security managers needs enough coverage to review requests promptly. That applies to any tool.
Try it yourself
Click through it at your own pace, or open it full screen.
Watch what happens when a gate blocks a change: that is the moment someone asks for an exception, and the moment cover matters.
Safeguard policies and gates can block builds on rules you set, and its compliance and evidence automation helps keep the approval records together. You can run a free scan to see what a gate would catch.
Quick check
Can a manager approve on behalf of someone who reports to them?
Only if the policy gives them that decision right. Authority should match or exceed the original approver for the severity involved.
Should the requester be able to choose the deputy?
No. Deputies are set in advance by the role owner, otherwise the requester can shop for the easiest yes.
What if nobody responds at all?
Escalate one level at the timer. Never default to approve, because silence is not a decision.
Sources
Last reviewed: 19 October 2026.
