Workflow & approvals

Workflows are configurable state-machine approval flows that gate when a product (or other entity) may be published. A workflow moves an entity through states (for example draft → in review → approved / rejected) via transitions, each guarded by role and optional data conditions.

The seeded approval flow

A fresh organisation ships with a Product approval workflow: draft → in review → approved / rejected. An editor submits a product for review; an admin approves it. The publish gate blocks publishing until the product is approved — enforced at both product-publish seams.

Data conditions

A transition can carry an exit condition, and a target state an entry condition. Both are evaluated (AND-ed) against a snapshot of the product's attributes and asset counts. Conditions run only through the safe compliance sandbox — never eval — and fail closed: a malformed condition, or one with no snapshot to evaluate, denies the move with a CONDITION_NOT_MET error. Every condition is parsed when you author it, so a broken expression is rejected up front.

For example, an entry condition of "image count ≥ 1" blocks approving a product that has no image.

SLAs and escalation

An SLA policy (per organisation, per workflow state) drives a background scanner. When a task is open past its due date it reminds the assignee; after a grace window measured from the reminder it escalates to the policy's role, optionally auto-reassigning to the least-loaded reviewer, and audits the step. Escalation is idempotent (none → reminded → escalated) so a task is never double-processed. The inbox has an overdue=true filter, and opening a task sets its due date from the policy.

Parallel approvals

A state can fan out to several parallel review branches. Reviewers explicitly claim a branch, then vote through the normal transition. A join rule (all, any, or quorum) advances the instance only when the rule is met; the first reject short-circuits as a veto and cancels the sibling branches. A reviewer can hold only one branch (distinct-approver enforced), and a parallel definition must provide both an approve and a reject outgoing edge.

Workflows and onboarding

When a supplier's product is imported through onboarding into a non-managed supplier org that has an active product workflow, the import creates the product as a draft and drives the initial submit transition as a system action, so the supplier's own publish gate governs the rest. Managed shadow orgs skip gating.