Runbook: access requests stuck or closed

Use this when a customer says a request "disappeared", "nobody can approve it" or "has been waiting for days". Nothing is ever deleted: every request is in access_requests with its state.

1. Find the request

Ask support for the person's email and roughly when they asked. In the client's region:

select id, state, depot_id, waits_on_person_id, moved_from_person_id, moved_at, created_at, closed_at
from access_requests
where person_id = :person and created_at > now() - interval '30 days';

2. Read its state

State	What it means	What the customer can do
waiting, waits_on_person_id set	waiting on that person	that person approves; or any administrator under All requests
waiting, no waits_on_person_id	nobody held the approver's role at the person's home depot when it came in	an administrator approves under All requests, or gives someone the role
expired	nobody decided it within 14 days; the nightly job closed it	ask again. Nobody was told it closed
approved / declined	decided; the audit log says by whom	–

Routing happens once, when the request comes in, and goes to the approver at the person's home depot, not the depot they asked for (src/Approvals/ApprovalRouting.php:47). A driver asking for access at a second depot waits for their home depot's manager.

3. When an approver changed role

Before 22 October, a request kept waiting on the person it was routed to, even after that person changed role. That is what kept Brakeline's six Leeds requests waiting from Friday to Monday (SUP-1184, ACM-256). Two tickets in 2025 had the same cause and were closed as can't reproduce, because nobody could see where a request had waited.

Since 22 October (ACM-320), a role change moves the depot's waiting requests to whoever approves there now, or to the client's administrators with "No approver at this depot". The request keeps moved_from_person_id and moved_at, and the approvals inbox shows "Moved from". A role changed in Entra ID moves requests at the person's next sign-in, not before.

4. Tell support

Write in the SUP ticket: the request's state, who it waits on, and the customer's way out (usually All requests). Don't change waits_on_person_id by hand in production.

Change history

Version	Date	Who	What
1	2 Jun 2025	Marek	First version
4	21 Sep 2026	Marek	Leeds (SUP-1184): requests stay with the person they were routed to
5	2 Oct 2026	Marek	Approver role per depot (ACM-247)
6	8 Oct 2026	Jonas	Home depot routing; expired requests aren't announced
7	22 Oct 2026	Marek	Waiting requests move on a role change (ACM-320)