When an internal audit or SOX review flags that a manager approved a transaction they initiated themselves—or approved the same transaction twice under two different organizational roles—the fix in Workday is Business Process → Maintain Advanced Routing on the step's related actions menu (secured by the Business Process Administration and Manage: Business Process Definitions domains in the System functional area). However, turning on a routing restriction without configuring an Alternate Security Group is one of the fastest ways to make Workday silently skip a required approval step as Not Required.
This guide explains the four Workday routing restrictions, the difference between Not Required skips and Unassigned Tasks, how Action steps and Delegation interact with prior-approver exclusions, and how One User Per Group Per Organization Required changes routing behavior.
1. The four routing restrictions in Maintain Advanced Routing
You can configure routing restrictions on workflow steps (except Initiation and Checklist steps, which cannot be rerouted):
| Routing restriction | Who Workday excludes from the step | Important platform behavior to know |
|---|---|---|
| Exclude Initiator | The user who initiated the business process event. | Prevents self-approval when an HR Partner, Finance analyst, or manager initiates a transaction and also holds the approving role on a downstream step. |
| Exclude Prior Approvers | Users who have already completed a prior Approval step in the same business process. | Workday identifies prior approvers only from completed Approval steps, not Action steps. If a user completed an earlier Action step (such as Review or Propose Compensation), Exclude Prior Approvers alone will not exclude them from a later Approval step. |
| Exclude Latest Reviser | The most recent person who revised the event (available on specific business processes such as Supplier Invoice). | If Approver A revises a supplier invoice during review, Workday excludes Approver A from approving the revised invoice so a second person must approve the change. |
| Exclude Event Subject | The user who is the subject (target) of the business process. | Prevents an employee who holds a broad or unconstrained HR/Finance role from receiving the approval task for their own personnel or financial event. |
2. Why Workday skips a restricted step as Not Required (and how Alternate Routing prevents it)
Here is the rule that surprises administrators during audit testing: when routing restrictions exclude all assignees who would otherwise receive the step, Workday skips the step as Not Required unless you configure Alternate Security Groups on the same screen.
Compare the two cases carefully:
- No one held the role before considering routing restrictions: If the primary security group on the step has zero role assignees for the target organization, Workday creates an Unassigned Task (causing the business process to stall Awaiting Action) without checking Alternate Security Groups. Alternate Security Groups are evaluated only when routing restrictions eliminate all potential recipients who otherwise existed.
- Routing restrictions eliminated the only assignee(s): Suppose a step routes to Manager, and the Manager initiated the event while
Exclude Initiatoris checked. Because the only assignee was eliminated by a routing restriction:- If Alternate Security Groups is blank, Workday marks the step Not Required and advances the business process without an approval.
- If you configure Alternate Security Groups (which lets you pick from the security groups permitted on the business process security policy plus Manager), Workday routes the step to the alternate group and records Approval by Alternate (or Approval Chain by Alternate) in the Process History and confirmation page.
When configuring Alternate Security Groups, you also choose how Workday resolves contextual security for the alternate group:
- Relative to the transaction: Evaluates the alternate security group based on the organizational context of the transaction target (Note: if Manager is not a valid security group for the step, you cannot select Relative to the transaction).
- Relative to the excluded user(s): Evaluates the alternate security group based on the organizational context of each user who was excluded by the routing restriction (for example, escalating to the excluded manager's own manager).
Also note how manual reassignment interacts with routing restrictions: when a business process administrator uses role reassignment on the Unassigned Tasks report, Workday enforces routing restrictions and alternate security groups. When an administrator manually selects a specific person on the Unassigned Tasks report, Workday bypasses routing restrictions.
3. Organization role-based routing (One User Per Group Per Organization Required)
On Approval, Consolidated Approval, and To Do steps, you can configure One User Per Group Per Organization Required when a transaction touches multiple organizations (for example, a costing allocation across three Cost Centers) and you need one approval from each organization:
- Overrides Alternate Routing: When you configure organization role-based routing on a step, Workday disregards any Alternate Routing you configured on that step, and you cannot select the
Alloption for that step on the business process definition. - Partial vs. empty role assignments across organizations: If a step routes to HR Partner across Supervisory Organizations A and B, and Organization A has an assigned HR Partner while Organization B has none, Workday routes the step to Organization A and skips Organization B without creating an Unassigned Task. An Unassigned Task is created only if none of the target organizations (A, B, or C) has anyone assigned to the role.
4. Delegation and Apply Routing Restrictions during Delegation
If an approver delegates their tasks, check the Apply Routing Restrictions during Delegation setting on the Edit Tenant Setup - Business Processes task:
- When Apply Routing Restrictions during Delegation is enabled and a delegate approves a step, Workday treats the delegate as a prior approver. If a subsequent or parallel step (even a parallel To Do step) has
Exclude Prior Approversenabled, that delegate is blocked from completing the second step and will not see it in My Tasks. - When routing restrictions block a delegate at the tenant level, Workday routes the task to the Alternate Delegate configured on the delegation (either Use Default Alternate, which routes to the delegate's primary manager, or a named alternate delegate; a manager cannot name themselves as an alternate delegate for their direct reports).
- Run the Business Process Tasks Not Delegated report to find tasks where both the primary delegate and the alternate delegate were excluded by routing restrictions.
Testing routing restrictions and proxy chains in kiweely
Verifying separation-of-duties rules requires testing the business process as the initiator, the excluded approver, the alternate security group assignee, and a delegate in Sandbox (see our multi-persona proxy testing guide). When you connect your Sandbox tenant in kiweely, the agent inspects the business process definition and its Maintain Advanced Routing configuration, flags steps where Exclude Initiator or Exclude Prior Approvers lacks an Alternate Security Group or overlooks an earlier Action step, and runs the end-to-end proxy test in the browser with your approval so you can see the exact Approval by Alternate entry in Process History.