OSL Institutional Approval System (Approval Rules & Approval Groups) Guide

1. What Is OSL Institutional's Approval System

OSL Institutional lets you require approval for key operations within your institution — such as creating an API Key, editing an API Key, or making a withdrawal. Once an operation type has an approval rule configured, when a team member initiates that operation it doesn't take effect immediately. Instead, it enters a "pending approval" state, and the system only carries out the operation once the designated approver(s) have signed off.

The approval system is made up of two parts:

• Approval Group: a set of people with approval authority. An Approval Group isn't tied to any specific operation type — it simply defines "this set of people forms one approval unit."

• Approval Rule: defines which operation type requires approval, and which Approval Group(s) must review it, along with the approval policy (for example, whether every member of the group must agree).

Whether an operation needs approval, and who approves it, is ultimately determined by the Approval Rule — and an Approval Rule relies on Approval Groups to supply the people. So the usual order for setting this up is: create the Approval Group first, then create the Approval Rule.

2. How to Set Up Approvals

2.1 Create an Approval Group

Go to Setting → Security → Approval Groups and click "+ New Group" in the top right.

• Group Name (required): give this Approval Group a name, e.g. "Treasury Committee"

• Members (required): select the team members who belong to this Approval Group; multiple selections are supported

Click Create Group once you're done. The new group appears in the list along with its name, member count, status (Active), and members. Existing groups can be adjusted at any time via Edit.

2.2 Create an Approval Rule

Go to Setting → Security → Approval Rules and click "+ New Rule" in the top right.

• Rule Name (required): give this rule a name, e.g. "Edit API Key Approval"

• Operation Type (required): choose which operation this rule applies to, e.g. "Create API Key" or "Edit API Key"

• Approval Groups: choose one or more of your existing Approval Groups to act as the approver(s) for this rule. If you add more than one group, the screen notes "Each group is notified only after the one above it approves" — meaning multiple groups approve in sequence: a group further down the list is only notified once the group above it has approved. Groups can be reordered by dragging, and you can click "+ Add approval group" to add another one.

Click Create Rule once you're done. The new rule appears in the list along with its name, status (Active), the Operation Type it applies to, its Approval Group(s) and approval policy (e.g. "Unanimous" means every member of that group must approve). Existing rules can be adjusted via Edit, or temporarily turned off via Disable.

3. How Notifications Work for Operations Under Approval

The example below walks through creating an API Key, assuming the "Create API Key" operation type already has an approval rule configured.

I. Initiating the operation: a team member completes the usual steps to create an API Key and submits it. If it matches a configured approval rule, the screen shows "Submitted for Approval", along with "Track approval progress on the Activity page. You will be notified once it is approved." At this point the API Key has not actually been created yet — the request is waiting on approval.

II. The initiator is notified: the initiator receives an in-app message (Notification Center → Message), such as "Your Create API Key Request Is Under Review," and can click Detail to jump straight to the approval detail page.

III. Approvers are notified: members of the matched Approval Group(s) receive both an in-app notification and an email letting them know a new request needs their review.

IV. The approver reviews the request: the approver goes to Activity → Approvals, finds the corresponding request, and opens the detail page. This page shows the specifics of the operation (e.g. Portfolio, Label, Access Level, Permission Settings, IP Address), and a Timeline on the right showing progress (Initiated → under review by the Approval Group → End). The approver can optionally add an Approval Note, then choose Approve or Reject.

V. The initiator is notified of the outcome: whether the request is approved or rejected, the initiator receives both an in-app message and an email with the result — for example, "Your Create API Key Request Is Approved" once it passes.

VI. The system only carries out the operation once approval is complete: only after the request has passed every Approval Group configured in the rule does the system actually perform the operation (in this example, actually creating the API Key). If the request is rejected, the operation is never carried out.

Before a decision is reached, the initiator can also click Recall on the detail page to withdraw their own request.

4. Viewing Approvals on the Activity Page

Go to Activity → Approvals to see every approval request relevant to you.

• The page can be filtered by Style (e.g. "Pending my approval") and Status, and supports search

• Table columns: Activity (the operation name), Initiated By (who submitted it and when), Status (current state and when it was last updated), and Actions (e.g. an "Approval" link when a request is awaiting your review)

• Clicking any row opens the detail page, showing the specifics of that operation, the full approval Timeline, and — if it's your turn to act — the available Approve / Reject / Recall actions