---
title: Approve or reject requests in the Vulnerability Manager Workspace
description: Approve or reject requests that are submitted by remediation owners.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/vulnerability-manager-workspace/vr-ws-approve-requests.html
release: australia
product: Vulnerability Manager Workspace
classification: vulnerability-manager-workspace
topic_type: task
last_updated: "2026-03-12"
reading_time_minutes: 3
breadcrumb: [Monitoring and managing vulnerable items and test results in the Vulnerability Manager Workspace, Vulnerability Manager Workspace, Vulnerability Response Workspaces, Unified Security Exposure Management, Security Operations]
---

# Approve or reject requests in the Vulnerability Manager Workspace

Approve or reject requests that are submitted by remediation owners.

## Before you begin

Roles required:

<table id="table_b32_g4m_zyb"><thead><tr><th>

Approval type

</th><th>

Approval levels required

</th><th>

Approver roles

</th><th>

Additional information

</th></tr></thead><tbody><tr><td>

False positive approvals

</td><td>

One

</td><td>

-   sn\_vul.false\_positive\_approver granular role for vulnerable items \(VITs\).
-   sn\_vul.app\_false\_positive\_approver role for application vulnerable items \(AVITs\)
-   sn\_vul\_container.false\_positive\_approver role for container vulnerable items \(CVITs\)
-   sn\_vulc.false\_positive\_approver for configuration test results

 Or

 Approvers are required to be in the False Positive Approver user group.

</td><td>

-

</td></tr><tr><td>

Exception approvals \(deferrals\)

</td><td>

Two

</td><td>

-   One approver is required in the Approver - Level 1 group
-   One approver is required in the Approver - Level 2 group

</td><td>

An exception request for a record or remediation task is approved by using a default, two-level approval workflow. The exception request requires two levels of approvers. After the request is approved by the level 1 approver, it’s sent on to the second-level approver and is then visible in approver 2's queue.

</td></tr><tr><td>

Unassign approvals

</td><td>

One approver is required in the Approver – Level 1 group

</td><td>

-   sn\_vul.unassign\_approver for AVITs and VITs
-   sn\_vul\_container.unassign\_approver for CVITs
-   sn\_vulc.unassign\_approver for configuration issues \(CIs\)

</td><td>

**Note:** By default, an approval configuration is provided and an unassign approval group is created. Users \(Unassign Approver - Level 1\) of this group can approve the request. This group contains an unassign approver role, sn\_vul.unassign\_approver, by default. You can modify or create a new group and update the approval configuration. To configure approval rules, navigate to the respective Approval Rules module, select any of the following approval rules, and navigate to the approval configuration in the **Approval Configurations** tab:

-   **Vulnerable item field change request** for a vulnerable item.
-   **Vulnerability field change request** for a remediation task.
-   **Application vulnerability field change request** for an application vulnerable item \(AVIT\).
-   **Approval for container management** for a container vulnerable item \(CVIT\).

</td></tr><tr><td>

Risk reduction approvals

</td><td>

Two

</td><td>

-   One approver is required in the Approver - Level 1 group
-   One approver is required in the Approver - Level 2 group

</td><td>

The approval flow for risk reduction is same as the exception approvals \(deferrals\).

</td></tr></tbody>
</table>See [Vulnerability Response personas and granular roles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/vr-persona-overview.md) and [Assign the Vulnerability Response persona roles using Setup Assistant](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/vr-assign-personas_SA.md) for more information about assigning persona roles to users and users to groups.

**Note:** Add users to the approval groups before you submit approval requests. If you create requests before you add users to the approval groups, the requests might not be visible to those users that have the approval permission.

## Procedure

1.  Navigate to **Workspaces** &gt; **Vulnerability Manager Workspace**.

    If an approver doesn’t have access to the workspace, approvals can be processed at **Vulnerability Response** &gt; **My Approvals** in the classic environment.

2.  Select the List view icon \(\[Omitted image "icon-polaris-list-workspace.png"\] Alt text: LIst view icon.\).

    The List page is displayed.

3.  In the Approvals filtered list, select **Assigned to me**.

4.  Locate a request that you want to process and then select the link in the State column.

    The Vulnerability State Change Approval record \(VCA\#\) is displayed.

5.  Choose one of the following options to approve or reject the request.

<table id="choicetable_p3t_h5x_wqb"><thead><tr><th align="left" id="d292394e321">

Option

</th><th align="left" id="d292394e324">

Description

</th></tr></thead><tbody><tr><td id="d292394e330">

**Click the Details tab, enter text in the Comments field, and click Reject**

</td><td>

-   A message is displayed indicating that there’s a rejected approval for the Vulnerability State Change Approval record.
-   The state on the Vulnerability State Change Approval record transitions to Rejected.
-   The state on the remediation task or the record remains the same.
-   The Vulnerability State Change Approval record is no longer displayed on your Approvals list view in the workspace.


</td></tr><tr><td id="d292394e354">

**From either the __Request__ or __Details__ tabs, click Approve**

</td><td>

-   A message displays indicating that the Vulnerability State Change Approval record is approved.
-   The state on the remediation task or the record transitions to Deferred.
-   Active records on the remediation tasks transition to Deferred.
-   The Vulnerability State Change Approval record is no longer displayed on your Approvals list view.


</td></tr></tbody>
</table>
**Parent Topic:**[Monitoring and managing vulnerable items and test results in the Vulnerability Manager Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-manager-workspace/using-vulnerability-manager-workspace.md)