Approval friction is the delay, confusion, or resistance that slows a request from being approved. In identity and security workflows, it usually appears when access requests, policy checks, or change approvals require too many steps, unclear ownership, or manual review. High friction can reduce agility, but too little can weaken control.
What Approval Friction Means in Security Workflows
Approval friction is not just administrative delay. In security and identity workflows, it reflects how many handoffs, checks, exceptions, and ownership disputes stand between a legitimate request and a decision, which directly affects both speed and control quality.
Friction can be intentional, such as when a request deserves extra scrutiny because it is high risk. It becomes problematic when the process is slow for the wrong reasons, including unclear approvers, duplicated reviews, or manual routing that adds delay without adding better risk decisions.
Why Approval Friction Happens
Most approval friction comes from process design rather than the request itself. Common causes include ambiguous decision rights, too many approval layers, inconsistent policy interpretation, and review queues that rely on people to remember context instead of using a clear workflow.
Another source is poor system integration. When identity, ticketing, access governance, and change management tools are not aligned, the requester may have to restate the same justification in multiple places, and approvers may lack the evidence they need to decide quickly.
What High Friction Does to Security and Operations
High approval friction can slow legitimate work, but it can also create shadow processes. When teams believe the formal path is too slow or too opaque, they may seek workarounds, which weakens governance and can leave access or changes outside normal review.
There is also a control trade-off. If approvals become too burdensome, people may approve by habit rather than judgment, or they may rubber-stamp requests to clear a backlog. In both cases, the control looks active while its security value falls.
How to Recognize and Reduce It
Approval friction is easiest to spot when the same request type repeatedly stalls, bounces between owners, or needs repeated clarification before anyone will sign off. That pattern usually means the process is carrying uncertainty that should have been resolved earlier in the workflow.
Reducing friction usually means making the decision path clearer, not simply faster. Requests should reach the right approver with enough context to decide once, and the process should distinguish routine approvals from those that genuinely need escalation or exception handling.
For security teams, useful benchmarks are whether the workflow supports consistent policy decisions, whether approvers understand their authority, and whether the process leaves an audit trail that explains why a request was approved or denied.
Risk and Threat Considerations
Approval friction creates a security risk when delay and ambiguity push users toward shortcuts, especially for access requests and emergency changes. It can also hide weak ownership, making it harder to see whether a request was reviewed for the right reasons or merely moved along to reduce backlog.
Failure mechanism: Excessive steps, unclear approver responsibility, or repeated manual rework increase latency and encourage bypass behaviour, including informal approvals, standing exceptions, or overreliance on routine sign-off.
Impact: The organisation may grant access or implement changes with weaker oversight, while also slowing legitimate work and reducing confidence that the approval process is consistently enforcing policy.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-1 — Access Control Policy and Procedures | Approval friction shapes how access decisions are governed and executed. |
| AC-6 — Least Privilege | Requests often become approval-heavy when privilege decisions lack least-privilege structure. | |
| AU-2 — Event Logging | Approval workflows need auditable records of who approved what and why. | |
| Recommendation — Define clear approval authority and decision criteria for access requests. Use least-privilege rules to reduce unnecessary approval steps and exceptions. Log approval decisions and exception handling for review and accountability. | ||
| NIST CSF 2.0 | PR.AA-05 — Identity and Access Management | Approval friction is a governance issue inside identity and access decision workflows. |
| Recommendation — Streamline access approval paths while preserving policy-based control. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Approval friction affects how access control decisions are authorised and administered. |
| Recommendation — Document access approval rules and ownership so requests do not stall unnecessarily. | ||
Practitioner Guidance
Governance implication: Treat approval friction as a workflow quality signal, not just an inconvenience. If the same process is repeatedly slow, the issue is often unclear decision ownership or poorly designed review criteria rather than an inherent need for more bureaucracy.
What to watch for: Repeated exceptions, delayed approvals for low-risk requests, and approvers who ask for the same missing information are signs that the workflow is not giving decision-makers what they need at the right time.
Practitioner takeaway: The best approval process is usually the one that makes good decisions easy and bad shortcuts unnecessary.
Related resources from NHI Mgmt Group
- How should security teams govern access requests without creating excessive approval friction?
- How should security teams use AI to improve privileged access decisions without adding more approval friction?
- When do self-service request and approval workflows create less friction without weakening governance?
- How should digital services teams reduce friction in carrier billing without creating approval gaps or failed transactions?