Direct answer
An approval queue is a list of objects in a pending state, with a named reviewer, a reason field, and an idempotent decision. It is not a Slack channel and not an email folder.
Access control belongs on the decision endpoint. The outbox pattern belongs on the notification that follows.
States you actually need
Draft, submitted, accepted, rejected, failed-to-notify. If ‘failed-to-notify’ is missing, you will double-send or silently drop. Microsoft’s transactional outbox write-up is the standard picture: persist the event in the same transaction as the decision, then publish.
A practical sequence
Make the queue visible before you automate it.
- Name the object and the reviewer role
- Store the decision with who and when
- Retry notifications independently of the decision
- Show the submitter the state without leaking other tenants
- Keep a manual retry on the operator panel
IA for the reviewer
NN/g: structure is the jobs. The reviewer needs oldest-first, filters by type, and a detail pane that does not lose the list on mobile. A 44 px accept/reject control is not optional.
What to send if you want a senior review
Share what is being approved and who may decide. Related work at Kiwi: SaaS MVP design and development. Walkthroughs available on request.
Frequently asked questions
Can we approve in email?
You can notify in email. The decision should hit a server you own, with auth, or a signed one-time token bound to that object. A reply-all is not an audit trail.
Is this the same as a client portal?
A portal may contain a queue. A queue may live only on the operator panel. Do not build both until the object exists.
How do we demo a queue?
Seed three pending items, one failure, and one accepted. Walk through retry. Do not use production tickets.
Sources
- OWASP — Enforce access controls
- Microsoft Azure Architecture — Transactional Outbox pattern
- Nielsen Norman Group — Information architecture vs. navigation
Figures cited above are drawn from the linked publications and are the responsibility of their sources; we date and scope them rather than presenting them as universal guarantees.