# Roles & approvals - CorebankOS

> Granular roles, approval chains and a complete audit trail - for your ops team in the backoffice and for business customers in their apps.

Source: https://corebankos.com/solutions/roles-approvals

## Four eyes on every risky click.

Granular roles, approval chains and a complete audit trail - for your ops team in the backoffice and for business customers in their apps.

- **40+** granular permissions out of the box
- **n-of-m** approval rules on any sensitive action
- **0** shared logins - SSO and per-user access
- **100%** of actions attributable in the audit log

## Roles that match how your bank works.

Start from templates for each team, then scope them by country, product or segment. Policies are code-reviewed like everything else.

```yaml
# Who can release high-value payments
policy: release_payment
applies_to: amount > 10000 EUR
approvals:
  required: 2
  from_roles: [finance_lead, cfo]
  not_initiator: true
expires_after: 24h
audit: always
```

- Templates for Ops, Risk, Finance and Support
- Scopes by country, product or customer segment
- Temporary access that expires on its own

## Access you can explain to an auditor.

Every permission, approval and session is recorded - and reviewable by the people responsible for it.

- **Role templates**: Sensible defaults for every team, editable in minutes.
- **SSO & MFA**: SAML and OIDC single sign-on with enforced MFA for staff.
- **Approval chains**: n-of-m approvals by amount, action or customer risk.
- **Time-boxed access**: Break-glass and temporary roles that expire automatically.
- **Session review**: See who did what, when and from where.
- **Access reviews**: Quarterly attestations generated for your auditors.

## Approvals inside the business apps too.

The same engine powers approvals for your business customers - finance leads approve payments, admins manage users and limits.

- Payment approvals by amount and payee
- User roles for admins, approvers and viewers
- Mobile approvals with biometric confirmation

## Questions, answered.

Identity, approvals and the audit log.

### Can we connect our identity provider?

Yes. Staff sign in with SAML or OIDC single sign-on, with MFA enforced by policy.

## Try approving a payment.

Set up a two-person rule in the demo and approve a payroll batch from your phone.