> For the complete documentation index, see [llms.txt](https://docs.abbey.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.abbey.io/use-cases/approval-workflows/using-multiple-approval-steps.md).

# Using Multiple Approval Steps

In this guide, you'll learn how you can configure a Grant Kit to have multiple review steps. Each step will contain a list of reviewers required to approve or deny an access request.

We will be using the [Using a Single Approval Step](/use-cases/approval-workflows/using-a-single-approval-step.md) as a base and modify it to this use case.

## Step 1. Add Another Workflow Step

Add another step to our workflow, but this time add an additional reviewer

{% code title="main.tf" lineNumbers="true" %}

```diff
resource "abbey_grant_kit" "null_grant" {
  ...

  workflow = {
    steps = [
      {
        reviewers = {
          one_of = ["alice@example.com"]
        }
-      }
+      },
+      {
+        reviewers = {
+          one_of = ["bob@example.com", "carol@example.com"]
+        }
+      }
    ]
  }

  ...
}
```

{% endcode %}

We now have a workflow with two steps. These steps will run serially.

First, Alice will be notified to review. If she approves, Bob and Carol will be notified to review. If Alice denies the request, then the access request overall will be denied. Bob and Carol wouldn't be notified at all in this scenario.

Second, Bob and Carol are requested to review. Either of them may approve the request because of the `one_of` constraint was configured. Further, if Bob approved and Carol hasn't responded, the overall step will be considered approved.

## Step 2: Add Another, Stricter Workflow Step

Add another workflow step and have a stricter constraint for reviewers.

{% code title="main.tf" lineNumbers="true" %}

```diff
resource "abbey_grant_kit" "null_grant" {
  ...

  workflow = {
    steps = [
      {
        reviewers = {
          one_of = ["alice@example.com"]
        }
      }
      },
      {
        reviewers = {
          one_of = ["bob@example.com", "carol@example.com"]
        }
-      }
+      },
+      {
+        reviewers = {
+          all_of = ["dan@example.com", "eve@example.com", "frank@example.com"]
+        }
+      }
    ]
  }

  ...
}
```

{% endcode %}

We now have a 3 step workflow. The last step requires all reviewers in the list to review.

If one of these reviewers deny the request, then the overall request will be denied. If less than all reviewers approve, then the step will wait until everyone approves.

{% hint style="info" %}
By default, Abbey waits for 1 week for pending access requests before automatically denying them. This is to reduce access request debt and ensure you have more tidy access management.
{% endhint %}