vCO output as criteria for triggering an approval policy

[qc4vmware]

At this point anything useful I have thought I might want to wrap a policy around has not been possible.  When I first glanced at the approval system and saw the conditional options for the approval levels I was impressed but now I realize its more like having cable tv...  It is like having a 150 channels I don't want to watch.  I want my approvals to be triggered by things which might be fairly complex and also likely include some of what are custom properties currently.  It seems like it should be a very easy thing to implement triggering these based upon the result of a string comparison from a vCO output or a boolean. 

For example... lets take Joe User.  Joe is on legal hold.  I want to stop any user on legal hold from automatically deploying anything new.  I can perform a simple query to check his status via a vCO workflow.  I don't particularly want to muck with modifying his group memberships in AD or change anything in the vCAC configuration to meter this.  I just want someone to be notified and say yay or nay then once he's off legal hold all the configurations are the same.  If its true activate the policy if not let it through. 

I could think of lots of scenarios where I would like to use more intelligent and customized criteria on the policy triggers.  I don't think using business groups and reservations will scale the way we want.  I'd rather have fewer larger groups and reservations and more policies that we tweak.  If the quota system was more intelligent and could trigger policies and also expand the resources appropriately if that request was approved I might consider the lots  of business groups/reservations route.

Let me know if I am crazy as I am still learning how to navigate vCAC.  I'd be happy to hear how others are dealing with this kind of thing in the 6.x realm.

[jddias]

Just spit-balling but what if you had an ASD service blueprint for putting Joe User on legal hold, which would create a resource of some type (maybe 'legal hold flag').  The workflow for legal hold would move Joe to a custom group that would trigger an approval policy based on his membership in that group, via entitlements.

In other words, control the approval process based on the entitlements - you can have a "normal" entitlement with standard approvals and then a "legal hold" entitlement with enhanced approvals.  You don't have to futz with BGs or reservations - this would all be done within the governance engine in vCAC not IaaS.

Not saying that's the most elegant approach but I think that would be a workaround.

(PS - the 'legal hold flag' resource would just be a way to manage Joe's status - not a requirement.  And, that's not quite possible .... yet!)

[qc4vmware]

I appreciate the idea but I think doing it that way would be pretty challenging in our environment.  We have so many legacy systems and procedures inserting yet another place where you would need to update a status or set a flag would be challenging.  I think it would be more likely we'd automate the creation of something like you are suggesting but we don't have api's or vCO automation which can accomplish this in the products current state.  I might be able to manage this particular example just with entitlements as you suggested (probably no need for the advanced service to move the user to a group as they are already in one in this use case) but I am trying to keep the number of blueprints, entitlements, business groups, and reservations to a minimum.  I can see all of that quickly ballooning out of control and becoming a management nightmare.  Especially as we move beyond IaaS into the application space where we have the potential for thousands of blueprints.

[Sirry]

I feel like I don't understand your environment/requirements totally, but hopefully this helps; POC works in our environment.

Re: How can I create a vCAC approval policy with a custom property threshold?