---
title: "How to set up pre-approval access for GAT Flow?"
description: "**Unlock** is a feature within GAT+ that allows Google Workspace admins to take different actions across their domain. The Unlock functionality is required for: - Viewing content of Files and Emails - Changing ownership of Google Drive Files - Copying…"
url: "https://gatlabs.com/knowledge/tech-tips/how-to-set-up-preapproval-acces-for-flow/"
updated: "2025-11-19"
category: Delegated Access
tags:
  - GAT Flow
  - GAT Unlock
---

# How to set up pre-approval access for GAT Flow?

**Unlock** is a feature within GAT+ that allows Google Workspace admins to take different actions across their domain.

The Unlock functionality is required for:

- Viewing content of Files and Emails
- Changing ownership of Google Drive Files
- Copying Google Drive folders and moving them to another user
- Adding or removing users from Drive and Shared Drive files
- Setting up email delegation to user accounts
- Using the GAT Flow functionality to:
  - - Onboard users into the domain
    - Offboard users from the domain
    - Modify users in the domain

The Unlock functionality requires each of the actions above to be **approved by the Security Officer. **This is designed as a security feature.

***NOTE:** To have **access to GAT Flow** you **must** have  **GAT Unlock****configured**, this product requires a paid subscription.*

## What is pre-approved access in GAT Flow?

Preapproval in Unlock allows the action chosen for **Flow, Drive, or Email** to be done **without the need of the Security Officer's approval for every request.**

i.e.: Allowing Unlock to be used without approval by the Security officer.

**The Pre-approval configuration must be set up or approved by Security Officer.**

## How to set up GAT Flow pre-approval in GAT+?

Navigate to **GAT+ > Configuration > Security Officer > Access permissions **

![GAT+ dashboard showing how to create Pre-approval permissions.](https://gatlabs.com/knowledge/wp-content/uploads/2021/12/SO1.png)

In **Access Permissions** click on the **+** button **<- Click here to create new preapproved access**

A new window will be displayed fill in the details required:

- **Authorized user** - select the user who you want to set pre-approved access to
- **Type** -**Flow**, Drive, Email
- **Scope** - User, Group, Org.Unit
- **Valid until** - set the time until pre-approved access will be granted
- **Flow types**- select the type of workflow
  - Onboarding
  - Offboarding
  - Modify

!["Add preapproved access" configuration window is displayed. Pre-approved access can be configured for a particular users, "Scope" can be applied and the "Valid until" date set up. ](https://gatlabs.com/knowledge/wp-content/uploads/2021/12/SO3.png)

Click on **Save**and the configuration will be added to the Access permissions table (see below).

![Pre-approval records shown in a table. ](https://gatlabs.com/knowledge/wp-content/uploads/2021/12/SO4.png)

**IMPORTANT**: If an **Administrator** who also serves as a **Security Officer** creates pre-approved access for themselves, **it cannot be automatically approved for security reasons**. It requires second Security Officer to review the request and approve it.

If second **Security Officer** creates such access for the**Administrator**, **it will be automatically approved** because they, as the second party, authorized the access.

## Flow Pre-Approval Setup

Navigate to **Flow > Configuration > Preapproved access > + New Preapproved Access**

![GAT Flow dashboard showing how to set up pre-approval access.](https://gatlabs.com/knowledge/wp-content/uploads/2021/12/SO-5.png)

A new window will be displayed fill in the details required:

- **User** - select the user who you want to set pre-approved access to
- **Scope** **type**- User, Group, Org.Unit
- **Scope **– enter the user/group/org.unit
- **Valid to** - set the time until pre-approved access will be granted
- **Flow types**- select the type of workflow
  - Onboarding
  - Offboarding
  - Modify

!["New Preapproved Access" configuration window is displayed. Pre-approval access can be assigned to a given user, "Scope" and the workflow "Type" (Onboarding, Modify, Offboarding) can be selected, and "Valid To" date selected.](https://gatlabs.com/knowledge/wp-content/uploads/2021/12/SO6.png)

Click on **Save**and the configuration will be added to the Access permissions table (see below).

![Preapproved Accesses displayed in a table. ](https://gatlabs.com/knowledge/wp-content/uploads/2021/12/SO8.png)

## Result

The **Pre-approved** access will **be granted** to the selected user automatically if created by Security Officer. ***Status =Approved***.

If  the Pre-approved is created by Super Admin who also serves as Security Officer, it **must be approved** by the second Security Officer for security reasons. ***Status = Pending* **until approved by Security Officer.

##### Pending Request Approval in GAT Flow

Security Officer can approve ***Pending*** requests in GAT Flow by clicking on the **Details** icon.

![The pending preapproved configuration can be reviewed by Security Officer. "Details" icon is shown that allows to review the record and Approve or Deny them.](https://gatlabs.com/knowledge/wp-content/uploads/2021/12/SO9.png)

The new window with option to ***Deny*** or ***Approve*** will be displayed.

![Window showing the Approve or Deny option for a Security Officer to approve the Preapproval configuration. ](https://gatlabs.com/knowledge/wp-content/uploads/2021/12/SO10.png)

##### Pending Request Approval in GAT+

Alternatively, Security Officer can approve ***Pending*** requests in GAT+ by clicking on the **More actions** icon. The options to ***Approve*** or ***Deny*** will be displayed.

![GAT+ dashboard showing how to Approve or Deny pending pre-approval configuration. ](https://gatlabs.com/knowledge/wp-content/uploads/2021/12/SO11.png)

Confirm the approval.

![](https://gatlabs.com/knowledge/wp-content/uploads/2021/12/SO12.png)

#### Pre-approval in Create Workflow Results

When pre-approval in Flow is enabled, the Admin will receive pop-up notifications every time they are about to send the request.

The pop-up will show them that **pre-approval is enabled and security officer is not required**

When the Admin **"Create workflow"**, they **will receive a pop-up message as below**.

![](https://gatlabs.com/knowledge/wp-content/uploads/2021/12/SO15.png)

#### Pre-approval in Event and Recurring Workflows

When Event or Recurring workflow is used:

- The Event and Recurring workflow needs to be **approved separately** from the Pre-approval
- The **"Pre-Approval"** option must be **selected when configuring the workflow**(see below)

![](https://gatlabs.com/knowledge/wp-content/uploads/2021/12/SO13.png)

## Edit & Delete Pre-approval setup

### Edit in GAT Flow

To edit existing pre-approved access, navigate to **Flow > Preapproved access**

- Click on the "pen" icon to edit existing preapproved access.
- Click on the "bin/trash" icon to delete the preapproved access.

![](https://gatlabs.com/knowledge/wp-content/uploads/2021/12/SO14.png)

### Edit in GAT+

To edit existing pre-approved access, navigate to **GAT+ > Configuration > Security Officer > Access permissions **

Find the**Preapproved access >** click on the**"eye"**icon and edit the **Flow types >**click on**Save ("check mark")**button**> "Changes saved!"** message will appear on the top right corner of the dashboard. You can now**Close** the configuration window.

![](https://gatlabs.com/knowledge/wp-content/uploads/2021/12/SO16.png)

**Video** of setting up pre-approval in Flow

[https://www.youtube.com/embed/pTiq5NYTa6g?feature=oembed&color=red&rel=0&controls=1&start=&end=&fs=0&iv_load_policy=0&autoplay=0&mute=0&modestbranding=0&cc_load_policy=1&playsinline=1](https://www.youtube.com/embed/pTiq5NYTa6g?feature=oembed&color=red&rel=0&controls=1&start=&end=&fs=0&iv_load_policy=0&autoplay=0&mute=0&modestbranding=0&cc_load_policy=1&playsinline=1)