I have seen quite some SAP GRC Access Control 10.0 access request workflows in action, but I wonder whether the following workflow exists in GRC or is easy to develop.
- Requestor - Request role creation/change/removal (request form should be in GRC)
- Role Owner - Approves or Rejects Request
- Role Designer - Maintains role (in case of approval), risk analysis is performed
- Security Specialist - Validates role, mitigate risk etc.
- Role Owner - Approves or Reject Requests