Manage SQL approval processes

Approval process groups centrally manage tasks in Database DevOps that require approval control. Configure whether each task type can be submitted, whether manual approval is required, which approval nodes are used, and which conditions select a process. Associate a process group with an environment, data source, or database group.

The three objects have different responsibilities:

• An approval process group is the scope for configuration and association.
• An approval process determines the submission and approval path for a task type based on its match conditions.
• An approval process template maintains approval nodes and can be reused by multiple processes in the same group. It does not manage process match conditions or priority.

The 09-09 SaaS release materials state that the authorization issue that prevented ordinary users from entering the approval-process page was fixed. The process-group, approval-process, and approval-node configuration described below remains controlled by the current role and module permissions. If an entry or configuration item is not visible, follow the authorization result shown in the current console.

Important notes

• This page is based on the current Database DevOps Enterprise Edition console verified in the daily environment. Entry points, task tabs, and configuration items can differ by organization permissions, product configuration, Edition, or deployment environment; verify other environments separately.
• A new process group must be copied from an existing group. The new group copies the source group's process configuration and then saves a new name and description.
• You can configure multiple processes under one task tab. When multiple processes match, the process with the highest priority starts approval; priority is determined by the process-card order.
• Templates maintain approval nodes only; configure process-level match conditions and priority in the approval process.
• A template referenced by an approval process cannot be deleted. Before deleting a process or process group, confirm its resource associations and business impact, and prepare a rollback plan.

Before you begin

• You have created or joined an organization, and this organization has subscribed to either DevOps Pro or DevOps Enterprise. Please ensure that your annual or monthly subscription is still active. For more information, please refer to Manage Organizations.
• Your current account has switched to the target organization. For more information, please refer to Switching to an Organization.

• Your organization role is Administrator.
• Decide the process group's scope and the task types, submission policy, approvers, and approval order to configure.
• If you will associate the group with an environment, data source, or database group, confirm that the target resource already exists and decide whether its inherited process group should be overridden.
• If you will enable external approval, first configure the application, process, callback, and permissions in the external approval platform. Then follow the links in Configure an external process channel to complete the NineData configuration.

Open an approval process group

1. Sign in to the NineData Console.

2. In the left navigation pane, click DevOps > Policy & Process.

3. On the Policy & Process page, click the Approvalprocess Group tab.

4. In the target process-group row, click Details to open Details and view or configure the group.

   To create a group from an existing group, use Duplicate in the target row. After opening the detail page, you can also open the page action menu and use the same entry. To enter the creation flow from the process-group list, use Create Flow Group.

Create a process group

A new process group must be copied from an existing group:

1. Open the Approvalprocess Group tab and click Create Flow Group. You can also click Duplicate in an existing process-group row.

2. In the opened Create Flow Group dialog, configure the following parameters:

   Parameter	Description
   Duplicate Process Group	Select the existing approval process group to use as the source. When you enter through Duplicate, the source group is selected by default.
   Name	Enter the new process-group name.
   Description	Enter a description for the process group if needed.

   tip

   If you enter this dialog through Duplicate, the source group is already selected. Confirm the name and description before submitting.

3. Click OK to create the group.

4. In the process-group list, click Details in the new group's row to open Details and continue the configuration.

Configure a process group

In Details, configure the following items:

• Enable Not Specifying Approvers to leave approvers unspecified within the process so that all approvers can review it.
• Enable No self-approval to prevent the submitter from approving their own work order.
• Open the task tab you want to configure and click Create Approval Process.
• On the process card, click Edit to open the edit form, Copy to open a creation form based on the current process, or Delete to delete the process.
• Drag the process cards to change their order. A card placed higher in the list has higher priority.

The current console may provide the following task tabs. The available tabs depend on the current Edition and console:

• SQL Task
• Apply Permission
• Archive & Clean
• Data Export
• Data Import
• SQL Code Review
• Track & Rollback
• Data Generation

MaxCompute data-source scope

In the current console, you can associate a MaxCompute data source with a SQL development policy and an approval process group from the data-source configuration. The available task tabs, approval conditions, and permission items for MaxCompute depend on the current Edition, data-source configuration, and organization settings; use the options shown in the current console.

Snowflake data-source scope

The 5.3.3 release materials confirm that Snowflake supports approval processes. In the current console, you can associate a Snowflake data source with a SQL development policy and an approval process group from the data-source configuration. The available task tabs, approval conditions, and permission items depend on the current Edition, data-source configuration, and organization settings; use the options shown in the current console.

OpenSearch data-source scope

The 09-02 SaaS release materials confirm that OpenSearch supports approval processes. When you use an OpenSearch data source, available task tabs, approval conditions, and permission items depend on the current Edition, data-source configuration, and organization settings. Use the options shown in the current console.

Create or edit an approval process

1. In Details, open the target task tab.

2. To create a new process, click Create Approval Process. To create one from an existing process, click Copy on the process card. To edit an existing process, click Edit on the process card. When you copy a process, the form is prefilled with the source process configuration; update it as needed before creating the new process.

3. Configure the following items:

   Configuration	Description
   Task Type	Select the task type when creating a process. When editing an existing process, follow the state shown by the page.
   Name	Enter the approval process name.
   Hit Conditions	Configure the conditions that select this process. Use All or Any for the combination mode, then use Add Condition to add a condition.
   Approve Manager	Select Allow to Submit or NOT Allow to Submit to determine whether a matching task can be submitted for approval.
   Enable Process	When submission is allowed, enable this switch to require manual approval. When disabled, the task passes according to the current policy.
   Approval Process Template	Select the approval process template used by the process. The template maintains approval nodes; configure the process's match conditions and priority in the approval process.
   New Template	If no suitable template exists, use this entry to create one directly. After creation, return to the process configuration and select the new template.
   Approval Node Configuration	Appears after you select a template and shows the approval nodes used by the process. To change them, click Edit Template to edit the template.

4. When the configuration is complete, click Create for a new process or Save for an edited process.

Approval conditions vary by task tab, Edition, and organization configuration. Do not treat the conditions visible under one task tab as a universal list; use the options currently provided under Hit Conditions in the form.

For approval processes that support an affected-row condition, NineData evaluates the sum of affected rows across all SQL statements in the task. The current condition form can also show descriptions for factors such as affected rows and request duration. The available factors and descriptions depend on the current console.

Manage approval nodes

Approval nodes are maintained in the approval process template.

1. In Details, click Approval Process Template to open the approval-process template management page.
2. Click Create Template to open the template-creation form. In the target template row, click Edit to open the edit form or Copy to create a copy of the current template.
3. When creating a template, enter Template Name and, optionally, enter Description. When editing an existing template, the template name and description are read-only; go directly to the Approval Process section.
4. In the Approval Process section, click Add to add an approval node. If you need external approval, enable Launch External Approval Workflow in the same section, then follow the corresponding document in Configure an external process channel.
5. Enter the node name in the Enter Name input, then select approvers in Select Approver. Select from Datasource Owner, Role, or User according to the options shown on the page.
6. In the node list, click to the right of a node to remove it, then check the approval order shown on the page. When creating a template, click Create; when editing a template, click OK.

The template page supports search using Search by Template ID / Name and shows Template ID, Template Name, Template Nodes, and Referenced Workflow. Before deleting a template, remove its references or switch the referencing processes to another template.

Configure an external process channel

You can configure multiple applications of the same external approval type. In the process mapping, select the specific application and its corresponding approval process.

External process-channel configuration depends on the application's, approval process's, callback's, and permission settings in the external platform. Follow the document for your platform: DingTalk approval, Feishu approval, Feishu Lark approval, or WeCom approval.

External approval link validity

Task-detail links generated by an external approval process, such as Feishu or WeCom, are valid for 7 days by default. The validity period is controlled by nd.sql.external.approval.expire.time.value; the default value is 604800000, in milliseconds.

• During the validity period, anyone who obtains the link can open the task details, regardless of whether they are task-related users.
• After the validity period expires, only system administrators and task-related users can open the task details.
• If your organization needs a different validity period, an authorized deployment or platform administrator must follow the configuration instructions for the current version and execute the corresponding configuration SQL in the meta metadata database. The parameter is not edited directly on the approval-process-group page; confirm the target environment, backup, and rollback plan before changing it.

caution

An external approval link provides access to task details. Set its validity period according to your organization's approval SLA and data sensitivity, and avoid forwarding the link to people who do not need to view the task.

Delete an approval process or process group

Before deleting anything, confirm that the target process has no pending tasks or business dependency. Deleting an approval process changes the approval path for later tasks.

• To delete an approval process, open the target task tab in Details, use Delete on the process card, and confirm the deletion in the confirmation dialog.
• To delete a process group, use the Delete action provided for the target group in the Approvalprocess Group list. If the page displays Associated envir. and datasources existed, Please modify first., click Modify Associated Process, move the associated resources to another process group, and confirm the change before deleting the original group.
• To delete a template, first remove its references or switch the referencing processes to another template, then delete the template.

caution

Deleting, editing, or reordering a process changes the approval path for later tasks. Verify the impact in an authorized disposable test scope first. For a production change, complete approval, backup, and rollback preparation in advance.

Associate a process group with an environment

After you associate a process group with an environment, data sources in that environment use the group's approval configuration by default.

1. Sign in to the NineData Console.

2. In the left navigation pane, click DevOps > Policy & Process.
3. Open the Envir. Config tab, find the target environment, and click Edit in the Actions column.
4. In the Edit Envir. Config dialog, keep the current SQL Dev Policy configuration, select the target process group only under Approval Process, and click OK.

Associate a process group with a data source

After you directly associate a process group with a data source, that data source uses the directly associated group instead of the group inherited from its environment. Other data sources in the environment are not affected.

1. Sign in to the NineData Console.

2. In the left navigation pane, click DevOps > Policy & Process.

3. Open the Datasource Config tab, find the target data source, and click Edit in the Actions column.

4. In the Edit Datasource Config dialog, clear the Inheriting Envir. Config option for Approval Process, select the target process group, and click OK.

   tip

   SQL Dev Policy and Approval Process use separate Inheriting Envir. Config options. When overriding only the approval process, leave the inheritance option under SQL Dev Policy selected.

5. To restore the environment configuration, select Inheriting Envir. Config under Approval Process again.

Associate a process group with a database group

Database groups are used for unified changes across distributed databases. After you associate a process group with a database group, that database group uses the directly associated group instead of the group inherited from its environment.

If the current organization has no database groups configured, the page displays No Data. Perform the following configuration only when the target database group is listed:

1. Sign in to the NineData Console.

2. In the left navigation pane, click DevOps > Policy & Process.
3. Open the DB Group Config tab, find the target database group, and click Edit in the Actions column.
4. In the Edit Group Config dialog, clear the Inheriting Envir. Config option for Approval Process, select the target process group, and click OK.
5. To restore the environment configuration, select Inheriting Envir. Config under Approval Process again.

Result

After you save the configuration, the process group takes effect at the configured scope. An environment-level group applies to data sources in that environment by default; a direct data-source or database-group association overrides the inherited group for that target.

Next steps

• Check the approver and node order in every approval process template.
• Check match conditions and process priority for every task tab so that each task matches only the intended process.
• Submit a test work order in an authorized test environment and confirm the submission, approval, and execution path before changing production configuration.