Incomplete Request Expiration

Access requests that sit pending for too long can become a compliance and security risk — the longer a request waits for action, the longer the requester or target user is left in limbo, and the harder it is to reason about what's outstanding. Incomplete Request Expiration lets you set a tenant-wide limit on how long an access request can remain incomplete before it is automatically denied.

This capability is enabled per tenant. If you don't see Incomplete Request Expiration in your access request preferences, reach out to your BalkanID contact to have it turned on.

What it does

When enabled, BalkanID tracks every access request that is still pending or awaiting consent. If a request stays in one of these states past the number of days you configure, BalkanID automatically denies it — no reviewer action required.

This applies tenant-wide, across all access request types. It does not affect requests that have already been approved, denied, or otherwise completed.

How it works

• The expiration threshold is configured in days from the request's creation date.

• Requests that are still Pending or Awaiting Consent once that many days have elapsed are automatically denied.

• The automatic denial is recorded in the request's Activity Log, attributed to System, with the message:

  Automatically rejected: request incomplete past the configured expiry threshold

• Setting the threshold to 0 disables automatic expiration — requests will remain pending indefinitely until a reviewer acts on them.

Automatic denial is final. Once a request is auto-denied, the requester must submit a new access request if access is still needed.

Seeing the countdown before a request expires

Once Incomplete Request Expiration is configured, a pending request's deadline is surfaced directly where reviewers act on it, if access request context is enabled for your tenant:

• In BalkanID for Slack, the reviewer's card shows a line like "⏳ Auto-denies in 2 days if undecided — Sep 10, 2026, 2:00 PM CDT". Selecting Refresh on the card recalculates this.

• In the web app, the request detail page shows a Decision due by field, with a warning indicator once the deadline is within 24 hours.

Configuring the expiration threshold

1. Go to Access Requests.

2. Click the settings (gear) icon in the top-right corner to open Access Request Preferences.

3. Under Security & Approval Controls, find Incomplete Request Expiration.

4. Enter the number of days before pending requests should auto-expire and get denied. Set this to 0 to disable the feature.

5. Click Save Preferences.

Viewing an auto-denied request

Once a request has been automatically denied, you can confirm this from its Activity Log:

1. Open the access request from the Access Requests list.

2. Click the activity log (under column 'Details') icon next in the access table review.

3. Look for an entry attributed to System with the action Access request denied and the message Automatically rejected: request incomplete past the configured expiry threshold.