An administrator, Trainer, who is assigned the Super_User profile, is trying to approve a workflow session that was submitted by another…

The FortiManager workflow mode introduces a structured change management process that operates independently of standard administrator permissions. Even an administrator with the SuperUser profile, which grants the highest level of access to all ADOMs and system settings, must be explicitly designated as an approver to authorize a workflow session. This designation is achieved by adding the administrator's account to a specific workflow approval group. If the 'Trainer' administrator is not a member of the required approval group, FortiManager will prevent them from approving 'Student's' session, enforcing the separation of duties intended by the workflow feature.

B. Trainer must close Student's workflow session before approving the request.

Closing a session would either commit the changes without approval (if permissions allow) or discard them; it is not part of the approval process.

C. Trainer must first create their own workflow session to approve student session.

Approving another administrator's work is a direct action on their submitted session and does not require the approver to create a separate, unrelated session.

D. Trainer does not have full rights over this ADOM.

This contradicts the premise. The SuperUser profile, by definition, grants full read/write permissions over all ADOMs on the FortiManager.

1. FortiManager Administration Guide 7.4.0

Chapter: "Workflow Mode"

Section: "Approving a session".

The documentation states: "To approve a session

you must be a member of the approval group. When a session is submitted for approval

an email is sent to the members of the approval group." This confirms that membership in the approval group is a mandatory requirement for approving a session.

2. FortiManager Administration Guide 7.4.0

Chapter: "Administrators"

Section: "Administrator profiles".

This section details the permissions for the SuperUser profile

granting "Read/Write" access to "All ADOMs" and system settings. It does not mention an inherent ability to override workflow approval group requirements

reinforcing that workflow is a separate control mechanism.