Setting Up Approval Workflows in Caisey: How to Configure Permissions for Your Technician Team

When your technicians connect to a client's machine, you want them to be effective—but not at the cost of security. Traditional remote support tools like ScreenConnect often give the technician full control the moment they're in. That's convenient, but it also means a junior tech can accidentally delete a registry key or run a destructive command without anyone noticing. Caisey changes that by putting approval workflows and role-based permissions at the center of your remote troubleshooting process. You decide who can run what, and you can require a second pair of eyes for sensitive actions. Here's how to set it up for your team.

The Problem with Full-Access Remote Support

Most remote support tools operate on an all-or-nothing model. Once a technician is connected, they can do anything: open a terminal, edit files, change settings, even reboot the machine. That's great when you trust the person completely, but it's a liability when you have a team with varying skill levels or when you need to meet compliance requirements like SOC 2 or HIPAA. You need to know who did what, and you need to prevent mistakes before they happen.

Caisey takes a different approach. Instead of granting blanket access, you define roles, assign permissions, and set approval policies. The technician can still troubleshoot effectively, but every action is scoped and, where needed, gated behind an approval request.

How Caisey's Approval Workflows Work

At a high level, Caisey's permission system has three components:

• Roles: A role is a set of permissions that you assign to a technician. For example, a "Technician" role might allow basic diagnostics and common fixes, while a "Supervisor" role can approve high-risk actions.
• Permissions: These define which commands or actions a role can execute. Permissions can be broad (e.g., "run PowerShell") or narrow (e.g., "only run Get-Process").
• Policies: Policies are rules that trigger an approval request. For example, you might set a policy that any registry edit requires approval, regardless of the role.

When a technician attempts an action that requires approval, Caisey sends a request to the designated approver (often a supervisor or the client). The action is blocked until the approver grants it, and the entire exchange is recorded in the session history.

Step-by-Step: Configuring Permissions in the Admin Console

Here's how to set up approval workflows in Caisey's admin console. The exact UI may evolve, but the core steps are stable.

1. Create Roles

Start by defining the roles your team needs. A common setup is:

| Role | Description | |------|-------------| | Technician | Can run diagnostics and common fixes, but cannot modify system settings or install software without approval. | | Supervisor | Can approve requests and perform high-risk actions. | | Auditor | Can view session logs and transcripts but cannot run commands. |

You can create as many roles as you need. For each role, you'll later assign specific permissions.

2. Assign Permissions

For each role, decide which commands and actions are allowed. Caisey lets you be as granular as you want. For example:

• Allowed: Get-Process, Get-Service, ipconfig, ping
• Require Approval: Set-ItemProperty (registry), Remove-Item, Restart-Computer, Install-Package

You can also set permissions at the client group level, so a role might have different permissions for a production server vs. a test workstation.

3. Set Policies

Policies are global rules that override role permissions. For example, you might set a policy that any action that writes to the registry requires approval, even if the role technically has permission. This is useful for enforcing security baselines across your entire fleet.

4. Enforce Across Client Groups

Caisey lets you group endpoints (e.g., by client, location, or criticality). You can apply different permission sets to each group. For instance, you might allow technicians to run Restart-Computer on a test machine without approval, but require approval for the same command on a production database server.

Example: Role Definitions and Enforcement

Let's walk through a concrete example. Suppose you have two roles: Tech and Lead. Here's how you might configure them:

| Action | Tech | Lead | |--------|------|------| | Run Get-Process | Allowed | Allowed | | Run Restart-Computer | Requires approval | Allowed | | Edit registry | Requires approval | Requires approval | | Install software | Requires approval | Allowed |

Now, imagine a technician connects to a client's machine and tries to restart a service. If Restart-Computer requires approval, Caisey will show a prompt: "This action requires supervisor approval. Request approval?" The technician clicks request, a notification goes to the Lead, and the Lead can approve or deny. The entire exchange is logged.

This workflow is especially valuable when you have junior technicians or when you're working with a client who wants to stay in the loop. It also gives you a clear audit trail for compliance.

Compliance and Audit Benefits

One of the biggest advantages of Caisey's approval workflows is the audit trail. Every command, every approval request, and every decision is recorded in the session history. You can review transcripts, see who approved what, and export logs for compliance audits. This is a game-changer for MSPs that need to demonstrate due diligence.

Traditional tools often log the session but don't capture the decision-making process. Caisey does, because it's built on a remote support audit trail that preserves context and approvals.

Best Practices and Cautions

• Start with least privilege: Give technicians the minimum permissions they need to do their job. You can always escalate later.
• Review permissions regularly: As your team grows or your client requirements change, revisit your roles and policies.
• Test your workflows: Before rolling out to a production client, test the approval process on a test endpoint to make sure it works as expected.
• Communicate with your team: Make sure technicians understand why approvals are required and how to request them. A quick training session can prevent frustration.

Conclusion

Setting up approval workflows in Caisey is straightforward, and it gives you a level of control that traditional remote support tools simply don't offer. By defining roles, assigning granular permissions, and enforcing policies, you can reduce risk, meet compliance requirements, and give your technicians the confidence to work without fear of making a costly mistake. Start with a simple role structure, test it, and refine as you learn what works for your team. Your clients will appreciate the extra layer of security, and your auditors will love the clear audit trail.

If you're new to Caisey, check out the remote troubleshooting overview to see how it fits into your workflow.