# How to prevent self-approval when a user has both requester and approver roles in NERM **URL:** \ **Category:** SHF Discussion and Questions\ **Tags:** identity-security-cloud, nerm\ **Created:** [September 4, 2026, 1:10pm UTC](https://developer.sailpoint.com/discuss/t/how-to-prevent-self-approval-when-a-user-has-both-requester-and-approver-roles-in-nerm/221464 "2026-09-04T13:10:01Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![MichaelCastillo7](https://avatars.discourse-cdn.com/v4/letter/m/bbce88/32.png) [@MichaelCastillo7](https://developer.sailpoint.com/discuss/u/MichaelCastillo7)\ **Post date:** [September 4, 2026, 1:10pm UTC](https://developer.sailpoint.com/discuss/t/how-to-prevent-self-approval-when-a-user-has-both-requester-and-approver-roles-in-nerm/221464/1 "2026-09-04T13:10:01Z")
Hello, In NERM I have two roles: - **Role A:** can initiate the use case to create a contract. - **Role B:** is responsible for approving or rejecting the approval form associated with the contract creation. The issue occurs when the same user has both Role A and Role B. For example, Juan has both roles and initiates the **Create Contract** use case. After completing the contract form, the workflow moves to an approval action that must be handled by a user with Role B. What I need is to prevent Juan from receiving or handling his own approval request, even though he also has Role B. In this scenario, the approval should only be assigned to another user with Role B who is different from the user who initiated the use case. For example, if Julieta also has Role B, I would like her to receive the approval form and be able to approve or reject it, while Juan is excluded from the approval because he initiated the request. Is there a way in NERM to dynamically exclude the workflow initiator from the list of approvers? Thank you. ---
**Author:** ![punna0001](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/punna0001/32/42011_2.png) [@punna0001](https://developer.sailpoint.com/discuss/u/punna0001)\ **Post date:** [September 5, 2026, 5:30am UTC](https://developer.sailpoint.com/discuss/t/how-to-prevent-self-approval-when-a-user-has-both-requester-and-approver-roles-in-nerm/221464/2 "2026-09-05T05:30:05Z")
Hello María. I do not see a documented NERM option to dynamically exclude the requester from a role-based approval. With **Users with NEProfile role** or **Users with Collaboration role** , any user in the selected role can perform the approval. ([Workflow Actions](https://documentation.sailpoint.com/ne-admin/help/workflows/actions.html)) **Skippable approval** does not meet this requirement either, because it allows the requester to perform the approval rather than excluding them. If self-approval must be prevented, you would need to use a different supported approver model, such as a profile owner/contributor or selected contributor. That changes how the approver is determined; it does not provide “Role B except the requester.” For that exact requirement, I do not see a documented out-of-the-box option in NERM today. ---
**Author:** ![MichaelCastillo7](https://avatars.discourse-cdn.com/v4/letter/m/bbce88/32.png) [@MichaelCastillo7](https://developer.sailpoint.com/discuss/u/MichaelCastillo7)\ **Post date:** [September 9, 2026, 2:33pm UTC](https://developer.sailpoint.com/discuss/t/how-to-prevent-self-approval-when-a-user-has-both-requester-and-approver-roles-in-nerm/221464/3 "2026-09-09T14:33:43Z")
> [@punna0001](#): > > Si hay que impedir la autoaprobación, tendrías que usar un modelo de aprobador soportado diferente, como el propietario del perfil/colaborador o un colaborador seleccionado. Eso cambia la forma en que se determina el aprobador; no proporciona “Rol B excepto el solicitante.” Thank you very much for your response. I wanted to ask about the part where you mentioned: “If self-approval needs to be prevented, you would need to use a different supported approver model, such as the profile owner/contributor or a selected contributor. This changes how the approver is determined; it does not provide ‘Role B except the requester’.” Would you have an example of how an approval model using a selected contributor could be configured or how it would work? Thank you very much. ---
**Author:** ![punna0001](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/punna0001/32/42011_2.png) [@punna0001](https://developer.sailpoint.com/discuss/u/punna0001)\ **Post date:** [September 10, 2026, 1:37am UTC](https://developer.sailpoint.com/discuss/t/how-to-prevent-self-approval-when-a-user-has-both-requester-and-approver-roles-in-nerm/221464/4 "2026-09-10T01:37:01Z")
Hello María. Yes, one example would be: 1. Create a Contributor Search attribute such as `Contract Approver`. 2. In Add role, add Role B so only users with that role can be selected. 3. Add `Contract Approver` to a form/page that is completed before the Approval Form. 4. In Approval Form → Approvers → Selected contributor, select `Contract Approver`. The contributor selected in `Contract Approver` can then perform the approval. ([Managing Attributes](https://documentation.sailpoint.com/ne-admin/help/profile-types/attributes.html), [Workflow Actions](https://documentation.sailpoint.com/ne-admin/help/workflows/actions.html)) Add role only limits the choices to Role B users. It does not exclude the requester. If Juan also has Role B, he can still be selected. So this is useful when you want to choose a specific Role B user before the approval step, but it does not by itself provide the original “Role B except the requester” behavior. ---
**Author:** ![kannan\_sb85](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/kannan_sb85/32/35971_2.png) [@kannan\_sb85](https://developer.sailpoint.com/discuss/u/kannan_sb85)\ **Post date:** [September 10, 2026, 4:47pm UTC](https://developer.sailpoint.com/discuss/t/how-to-prevent-self-approval-when-a-user-has-both-requester-and-approver-roles-in-nerm/221464/5 "2026-09-10T16:47:21Z")
@MichaelCastillo7 NERM does not have an option that allows the user to specify Exclude initiator from approver pool. I have reviewed, this has been raised several times in the community without any native solution available to address the case (approver role/contributor set contains the requester, requester should be excluded but the others should receive it).