--- title: "Reviewers and global approvers" slug: "about-access-review-reviewers" updated: 2026-11-06T14:30:13Z published: 2026-11-06T14:30:13Z canonical: "docs.senhasegura.io/about-access-review-reviewers" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.senhasegura.io/llms.txt > Use this file to discover all available pages before exploring further. # Reviewers and global approvers In a user review and certification campaign, every user is reviewed by one or more reviewers. Segura™ lets you assign a reviewer to each user and to each user group. A user can have several reviewers at the same time, and a review by any one of them completes that user's review. When a user has no reviewer at all, the global approver reviews them instead. Assigning reviewers keeps reviews with the people who know each user's access, instead of sending the whole user base to the global approver. ## Key concepts | Term | Meaning | | --- | --- | | Reviewer | A user who reviews another user's access in a campaign, whatever the source of the assignment. | | Direct reviewer | The reviewer set in the **Reviewer** field of a user's record. A user has at most one. | | Group reviewer | The reviewer set in the **Reviewer** field of a user group. Every member of the group has this reviewer. | | Global approver | A user registered as a global approver for the **User Management** module. Reviews the users who have no reviewer and, when the approval workflow is enabled, approves completed reviews. | ## How it works ### Reviewers add up A user's reviewers are their direct reviewer plus one reviewer for each user group they belong to. These assignments do not compete, and none of them overrides another. For example, a user with a direct reviewer who belongs to three groups with different reviewers has four reviewers. If two of the user's groups have the same reviewer, that reviewer counts once. ### Any reviewer can complete the review All of a user's reviewers see that user on the review screen, and all of them can review. The first reviewer to finish completes the review. The user's status changes to `Reviewed`, and the **Reviewed by** column shows who reviewed. The other reviewers see the same status and name. One review is enough. A user with four reviewers needs one review, not four. If **Enable approval workflow for users review and certification** is on, in **Settings > System Parameters > Global > Approval Flow**, a completed review also goes through approval. The global approver of the **User Management** module approves it. If two reviewers work on the same user at the same time, the first one to save completes the review. The second reviewer gets the message *This user has already been reviewed by* followed by the name of the reviewer. ### When the global approver reviews The global approver reviews a user in two cases: - The user has no direct reviewer and no group reviewer. - Escalation reaches the end of the reviewer chain without a review. Escalation passes a pending review to the reviewer's own reviewer, and so on, until it reaches the global approver. A user who has only group reviewers has a reviewer, so the global approver does not review them. Only global approvers registered for the **User Management** module review users. You cannot create a campaign while no such global approver exists. For details, see [Manage approvers](/v4-2/docs/manage-approvers). ### Nobody reviews themselves A user cannot be their own direct reviewer. Segura™ also refuses a reviewer that would create a cycle anywhere in the chain. For example, if A reviews B and B reviews C, C cannot be set as the reviewer of A. A group reviewer can be a member of that group, which is common when a team lead reviews their own team. In that case, the group reviewer is not counted as a reviewer of themselves. Their other reviewers still apply. If they have no other reviewer, the global approver reviews them. The global approver is the one exception, and only when you allow it. By default, a global approver cannot review or approve their own access. The **Allow global approvers to review and approve their own access** parameter allows it. See [System Parameters - Approval Workflow](/v4-2/docs/pam-session-system-parameters-approval-workflow). ### When reviewer assignments change Changes to reviewers take effect in campaigns that are already running: - **A reviewer is replaced.** Pending reviews move to the new reviewer. Completed reviews stay recorded with the reviewer who completed them. - **A group reviewer is cleared.** The group's members lose that reviewer. Members with no other reviewer go to the global approver. - **A user joins a group.** The user gets the group reviewer automatically. - **A direct reviewer is deactivated.** Their users move to the deactivated reviewer's own direct reviewer. If there is none, the global approver reviews them. - **A group is disabled.** The group no longer counts as a source of reviewers. - **A group reviewer is deactivated.** The group gets the deactivated reviewer's own direct reviewer. If there is none, members with no other reviewer go to the global approver. Segura™ does not notify a new reviewer when an assignment changes. It also does not notify the other reviewers when one of them completes a review. ### Users from identity synchronization You can set, change, and clear the direct reviewer of a user created by identity synchronization, the same as any other user. Active Directory synchronization does not set or clear the direct reviewer. ## Where to see reviewers The **Users by reviewer** report is the only place that shows which reviewers each user has. Access it in **Settings > Access control > Users review and certification > Users by reviewer**, or in **Reports > Review and certification > Users by reviewer**. It lists one row for each user and reviewer pair, with the **Assignment type** set to `Direct` or `Group`. Users with no reviewer appear with the **Assignment type** `None`. These are the users the global approver reviews. The **Users** and **User groups** reports do not show reviewers. Check this report before you start a campaign, to find users without a reviewer and reviewers with too many users. ## Who can do what - **System Administrator** users set and clear the reviewer of users and user groups. - Reviewers need the **Access review and certification** role to open the review screen. Being selected as a reviewer does not grant this role. - That role only reviews. By default, only **PAM Administrator** and **System Administrator** users create and manage campaigns. ## Related topics - [Access review and certification](/v4-2/docs/settings-about-review-and-certification-of-access-and-user-policies). - [Users](/v4-2/docs/users) and [User groups](/v4-2/docs/user-group), where you set reviewers. - [Users by reviewer](/v4-2/docs/reports-users-by-reviewer). - [Create a user review campaign](/v4-2/docs/how-to-create-a-user-review-campaign). - [Review a user's access](/v4-2/docs/how-to-review-a-users-roles). - [Manage approvers](/v4-2/docs/manage-approvers).