---
title: Configuring workflow step permissions
---

> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).

This topic shows you how to allow or deny editors approving and rejecting of pages in certain steps, or making certain step choices.

## Allowing users to approve or reject pages

Xperience allows you to assign different users and roles to different steps, which in turn allows the specified users and roles to approve or reject pages in a particular step.

> **Note:** The only steps to which you cannot assign different users and roles are the default:
>
> - _Edit_ step – any user who is editing the page can move the page to the next step.
> - _Published and Archived_ steps – only users with the _Manage workflow_ permission under the Content module, and users with the Global administrator [privilege level](https://docs.kentico.com/13/managing-users/user-management.md) can move the page from these steps.

This procedure applies to both basic and advanced workflow.

To allow users to approve or reject a page in a certain step:

1. Edit a step.
   - If you're using basic workflow, click **Edit** () next to the step. Note that this procedure is applicable only to custom steps in basic workflow.
   - If you're using advanced workflow, click **Edit** () in the step's header.
2. Switch to the step's **Security** tab. Note that in basic workflows, only custom steps have security tab.
3. Select which roles you want to be allowed to approve or reject the step. You have the following options:
   - **None**
   - **Only listed** – if you select this option, click **Add roles** to choose roles you want to add. If you don't add any roles, the result will be the same is if you select the **None** option.
   - **All except listed** – if you select this option, click **Add roles** to choose roles you want to exclude. All other roles will be allowed to approve or reject the step.
4. Choose if you want to include or exclude individual users from the list of allowed operators.
   - **No extra users**
   - **Include the following users**– if you select this option, click **Add users** to choose users you want to add to the list of allowed users. If you don't add any users, the result will be the same is if you select the **No extra users** option.
   - **Exclude the following users** – if you select this option, click **Add users** to choose users you don't want to be allowed to approve or reject pages in this step.

## Advanced workflows - Allowing users to make choices

When using workflow steps that allow multiple choices, you can allow or deny roles and users to send a page through certain branches of the workflow process.

You can allow or deny making choices in the properties of the individual choices. By default, choices inherit security settings form the step they belong to. If you adjust security settings for a choice, these settings will be added to the settings defined for the step.

When determining whether the current user can make a choice, the system first checks security settings for the step. If the user is allowed to approve pages in the step, the system checks whether the user is allowed to make choices. If a user is not allowed to approve pages in the step, the user will not be able to make any choices that belong to the step, regardless of the choices' settings.

To allow or deny users to make choices, follow these steps:

1. Edit the choice by clicking the **Edit** () button next to it.
2. Switch to the **Security** tab.
3. Define roles, which can approve (select) the choice. You have the following options:
   - **Use step settings**
   - **Only listed** – when selected, you can add roles that you want the choice to be allowed for using the **Add roles** button.
   - **All except listed** – when selected, all users in roles on all sites will be allowed the choice, except for users in those roles, which you select using the **Add roles** button.
4. Define additional users, who can approve (select) the choice. You have the following options:
   - **Use step settings**
   - **Include the following users**–if you select this option, click **Add users** to choose users you want to add to the list of allowed users. If you don't add any users, the result will be the same is if you select the **No extra users** option.
   - **Exclude the following users** – if you select this option, click **Add users** to choose users you don't want to be allowed to approve or reject pages in this step.