Lifecycle & Access Governance
Workflow Participation
Take an approver off the approval workflows they no longer belong in, with a justification on the record.
Completes when the person is removed as an approver from the selected workflows, once the request is approved.
https://mcp.avatier.com/mcp
Ask in Plain Language
Run Workflow Participation from the AI Assistant You Already Use
Your Lifecycle Management approval workflow decides who approves the removal, with identity verification first in Avabot and MCP. One completed participation removal = one Secure Outcome; failed attempts are never billed.
You: Take me off the Finance Share approval workflow. Justification: moving to the Sales team. Avatier: verify: passed · workflows: 1 selected · request: submitted, number returned
Why it matters
Approval Authority Should Follow the Job.
When an approver changes jobs or leaves a team, the workflows that route requests to them should change too.
What a removal needs
The approver, the workflows where they approve, picked from a list, a time, and a justification.
What goes wrong by hand
Editing workflows by hand to take someone off leaves no request, no approval and no record of who removed them or why.
What Workflow Participation does
It lists the workflows where the person is an approver, by name, item type and resource, and files one removal request for the ones you pick. No directory account is changed.
What per-seat pricing charges
Per-seat IAM charges for every licensed seat, whether any approver changes this month or not. Pay Per Identity Action™ charges only for completed participation removals.
The Action
How Workflow Participation Runs
On the web, Workflow Participation walks through these screens. In Avabot and MCP you verify, name the person or yourself, pick workflows from the list, give a justification and confirm.
Verify in Avabot or MCP
Avabot and MCP only. Workflow Participation starts with identity verification in the conversation, with the methods your policy already allows. On the web there is no extra check beyond your sign-in. Workflow Participation is high-risk, so by default it starts only if you verified in the last 5 minutes; otherwise you verify again.
Identity Verification (Avabot and MCP)
Select the Approver
Search for the approver: yourself, or someone you can request for. Removing yourself and removing others are separate tenant settings. Workflow admins are then asked "Would you like to use workflow?"
Set the Time and Justification
Choose now or a date, and enter a Justification. A workflow admin who skips workflow goes straight to the list.
Review the Workflows
The workflows where that person is an approver are listed by name, item type and resource. Search, filter by item type or export the list to PDF or Excel.
Select and Remove
On the workflow path, choose Edit, tick workflows or Select All, then Remove and confirm. The removal is recorded in Request History with a Request ID and goes through your Lifecycle Management approval workflow.
Approval point
Available on Web, Mobile, Teams, Avabot chat and MCP.
Avabot chat and MCP require the current (.NET 10) Avatier server.
In Avabot chat and MCP, the list shows up to 200 workflows, and the removal is always filed as a request.
Secure Outcome
What Counts as Done
A Secure Outcome is a completed, verified, policy-compliant identity action. A participation removal completes when the person is removed as an approver from the selected workflows, after approval at the chosen time. No directory account is changed. One completed participation removal = one Secure Outcome.
Evidence
- A Request ID in Request History (filter Remove Workflow Participation, exportable)
- An activity-log entry
- The request number, quoted in Avabot
Guardrails
Your Assistant Asks. Avatier Decides.
Verified First
Avatier verifies the person before sensitive changes, with the methods your policy already allows.
Acts as the Signed-In User
OAuth sign-in to your own tenant. No shared service account, no API key to manage.
Never Makes Up Values
The connector only sends what the person actually said, and asks when something is missing.
Every Request Recorded
Requests land in Request History, ready to review and export.
Pay Per Identity Action™
Pay per Completed Participation Removal
Pay per completed participation removal. Failed attempts are never billed.
| Compared | Manual or Per-Seat IAM | Workflow Participation, Pay Per Identity Action™ |
|---|---|---|
| What you pay for | Every licensed seat, whether it acts or not | Completed participation removals only |
| Failed attempts | No line between an attempt and a result | Attempts, failures and retries are never billed |
| The work | Manual intervention or tickets | Once approved, the person is removed as an approver from the selected workflows |
| Evidence | Silent failures and missing audit trails | A Request ID in Request History and an activity-log entry |
Pay Per Identity Action™ is in invitation-only preview. Pricing is shared with qualified organizations.
Works with the Workflows Workflow Participation Touches
Workflow Participation changes Avatier's Lifecycle Management approval workflows only. No directory account is changed.
- Lifecycle Management approval workflows
Avatier MCP
New to Avatier MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
Up and Running in Under a Minute
One URL works in every MCP client. Pick yours, copy, paste, sign in.
Microsoft Copilot Studio
Claude Code
OpenAI Codex
Cursor
Frequently Asked Questions
Can approvers take themselves off a workflow?
Yes, if your tenant allows users to update their own workflow participation. Removing someone else needs a separate setting and authority over that person.
Is the removal immediate?
No. It is filed as a request and takes effect after approval. On the web, workflow admins can choose not to use workflow.
How is this different from Proxy My Authority?
Proxy lends your approval authority to someone for a set period. Workflow Participation removes a person as an approver from the selected workflows.
Does Avatier provide AI-driven compliance reporting?
Yes. Avatier turns continuous identity and access data into audit-ready reports on demand, using AI to assemble who has access to what, what changed, and who approved it, mapped to the controls auditors expect. Instead of a manual evidence scramble before each audit, you generate plain-language, exportable reports covering SOC 2 Type II and ISO 27001, plus the evidence needs associated with NIST, SOX, HIPAA, and GDPR.
What is AI-driven configuration?
Avatier's AI-driven config turns plain-language intent into working policy. Rather than hand-coding rules, connectors, and roles, administrators describe what they need and Avatier recommends and sets up provisioning rules, role mappings, and workflows, then validates them before they go live. It shortens deployment from months to days and keeps configuration consistent, auditable, and free of custom scripting.
What is Pay Per Identity Action™?
Pay Per Identity Action™ is Avatier's pricing mechanic. Customers pay only for completed, verified, policy-compliant identity actions, called Secure Outcomes.
Is it the same as pay-per-action advertising?
No. Pay per action (PPA) is performance-marketing vocabulary for paying when an ad converts. Pay Per Identity Action™ charges for completed identity work.
How do I get started?
Getting started is free, deployment services are included, and a 45-day money-back guarantee applies. Contact Avatier for pricing for your organization.
What is MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
How is it billed?
Pay Per Identity Action™ is in invitation-only preview: each completed, verified action is one Secure Outcome, and attempts, failures and retries are never billed.
Workflow Participation
You've Automated the System. Now Secure the Approvals.
Pick the workflows, give a reason, and the removal is recorded in Request History with a Request ID.