Lifecycle & Access Governance
Pending Requests
Approve or deny the requests waiting on you, with a comment on the record.
Completes when your decision and comment are saved on the request, under its existing Request ID.
https://mcp.avatier.com/mcp
Ask in Plain Language
Run Pending Requests from the AI Assistant You Already Use
Your approval workflows route the requests to you, with identity verification first in Avabot and MCP. One completed decision = one Secure Outcome; failed attempts are never billed.
You: Show my pending requests and approve the Finance Share request for Sam Ortiz. Comment: confirmed with his manager. Avatier: verify: passed · request: read back · decision: approve · comment: added
Why it matters
Approvals Stall When They Live in an Inbox.
Every request waiting on an approver is access someone is waiting for, or access that should not be granted at all.
What a decision needs
The requester, the target, the item, the justification and the approval progress in one place, and a decision with a comment.
What goes wrong by hand
Approving over email or chat leaves no decision on the request itself and no comment an auditor can read.
What Pending Requests does
It lists only the requests routed to you, saves your decision on the request, and sends it to the next approver or runs it after the last approval.
What per-seat pricing charges
Per-seat IAM charges for every licensed seat, whether anyone approves anything this month or not. Pay Per Identity Action™ charges only for completed decisions.
The Action
How Pending Requests Runs
On the web, Pending Requests walks through these screens, one request at a time or in bulk. In Avabot and MCP you verify, hear your requests five at a time, pick one, decide, add a comment and confirm.
Verify in Avabot or MCP
Avabot and MCP only. Pending Requests starts with identity verification in the conversation, with the methods your policy already allows, such as Avatier Questions, Google Authenticator, PingID Push or Identity Challenge Card. On the web there is no extra check beyond your sign-in. Pending Requests is high-risk, so by default it starts only if you verified in the last 5 minutes; otherwise you verify again. Where Avatier has turned on sign-in reuse for the connector, an external assistant's own Avatier sign-in counts if it meets the same 5-minute rule.
Identity Verification (Avabot and MCP)
Open the Queue
Open Pending Requests; the menu badge shows how many are waiting. Filter by type, flagged or date, sort or search. Only requests currently routed to you are shown; workflow admins can switch to Admin to see every request in flight and Skip Approver, Cancel Request, Remind or Recover.
Open a Request
See the requester, target, item, justification, form data and approval progress.
Make Your Decision
Under "Your decision", type a comment and, where your admin allows it, adjust the start and end dates, schedule disable or delete dates, or rename a new group. A comment is required by default for both Approve and Deny.
Approve or Deny
Tap Approve or Deny; a banner confirms and you return to the queue. Approving sends the request to the next approver, or runs it after the last approval. For several at once, tap Edit, select requests, then Approve or Deny with one comment.
Approval point
Available on Web, Mobile, Teams, Avabot chat and MCP.
Avabot chat and MCP require the current (.NET 10) Avatier server.
In Avabot chat and MCP, you decide one request at a time (approve, deny or skip), with no Admin mode, bulk decisions or date changes. In Avabot chat you can also start from the Pending Requests home tile while the home screen is in Talk or Text mode.
Secure Outcome
What Counts as Done
A Secure Outcome is a completed, verified, policy-compliant identity action. A decision completes when it is saved, with its comment, on the existing request, under the same Request ID, and written to the audit log. After the final approval the request runs, or waits for a grantor when the target system is manual, and its status shows in Request History. One completed decision = one Secure Outcome.
Evidence
- Your decision and comment on the request, under its Request ID
- An audit-log entry (approved, denied, skipped, cancelled and so on)
- The request's status in Request History
- An Excel or PDF export of the queue or a request
Guardrails
Your Assistant Asks. Avatier Decides.
Verified First
Avatier verifies the person before sensitive changes, with the methods your policy already allows.
Acts as the Signed-In User
OAuth sign-in to your own tenant. No shared service account, no API key to manage.
Never Makes Up Values
The connector only sends what the person actually said, and asks when something is missing.
Every Request Recorded
Requests land in Request History, ready to review and export.
Pay Per Identity Action™
Pay per Completed Decision
Pay per completed decision. Failed attempts are never billed.
| Compared | Manual or Per-Seat IAM | Pending Requests, Pay Per Identity Action™ |
|---|---|---|
| What you pay for | Every licensed seat, whether it acts or not | Completed decisions only |
| Failed attempts | No line between an attempt and a result | Attempts, failures and retries are never billed |
| The work | Manual intervention or tickets | Your decision is saved on the request, which moves to the next approver or runs after the last approval |
| Evidence | Silent failures and missing audit trails | Your decision and comment on the existing Request ID, and an audit-log entry |
Pay Per Identity Action™ is in invitation-only preview. Pricing is shared with qualified organizations.
Works with the Systems Pending Requests Touches
Pending Requests decides requests for whatever system they target, such as Active Directory, Entra ID, LDAP and apps connected through connectors. Approved requests for manual systems go on to a grantor.
- LDAP
- Microsoft
- Active Directory and Entra ID requests, through their connectors.
- Other Systems
- LDAP and apps connected through connectors. Requests for manual systems go on to a grantor.
Avatier MCP
New to Avatier MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
Up and Running in Under a Minute
One URL works in every MCP client. Pick yours, copy, paste, sign in.
Microsoft Copilot Studio
Claude Code
OpenAI Codex
Cursor
Frequently Asked Questions
Do I have to type a comment to approve or deny?
By default yes, for both. An admin can make the comment optional for Approve and for Deny separately, and Avabot follows the same rule.
Can I approve several requests at once?
Yes, in the web and mobile app: tap Edit, select the requests, then Approve or Deny with one comment. Avabot handles one request at a time.
A request is stuck with an approver who is away. What can we do?
A workflow administrator can switch to Admin mode and skip the current approver, send a reminder, cancel or recover the request. Approvers can also hand off their authority with Proxy My Authority.
Does Avatier provide AI-driven compliance reporting?
Yes. Avatier turns continuous identity and access data into audit-ready reports on demand, using AI to assemble who has access to what, what changed, and who approved it, mapped to the controls auditors expect. Instead of a manual evidence scramble before each audit, you generate plain-language, exportable reports covering SOC 2 Type II and ISO 27001, plus the evidence needs associated with NIST, SOX, HIPAA, and GDPR.
What is AI-driven configuration?
Avatier's AI-driven config turns plain-language intent into working policy. Rather than hand-coding rules, connectors, and roles, administrators describe what they need and Avatier recommends and sets up provisioning rules, role mappings, and workflows, then validates them before they go live. It shortens deployment from months to days and keeps configuration consistent, auditable, and free of custom scripting.
What is Pay Per Identity Action™?
Pay Per Identity Action™ is Avatier's pricing mechanic. Customers pay only for completed, verified, policy-compliant identity actions, called Secure Outcomes.
Is it the same as pay-per-action advertising?
No. Pay per action (PPA) is performance-marketing vocabulary for paying when an ad converts. Pay Per Identity Action™ charges for completed identity work.
How do I get started?
Getting started is free, deployment services are included, and a 45-day money-back guarantee applies. Contact Avatier for pricing for your organization.
What is MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
How is it billed?
Pay Per Identity Action™ is in invitation-only preview: each completed, verified action is one Secure Outcome, and attempts, failures and retries are never billed.
Pending Requests
Every Decision, on the Request.
Open the requests routed to you, decide with a comment, and your decision is saved on the request under its Request ID.