Sales Order can be released while the order is submitted for approval in NAV

I recently investigated an issue for a client where an approver received and email to approve a sales order that were submitted for approval, but the status on the sales order was changed to open or released before it could be approved.

After trying to replicate this issue for days, I had a thought, look at the record restrictions created by the workflows. If you look at all the general sales order workflow templates that are available in NAV, when you create a workflow from those templates they all have record restrictions in them to restrict any changes to those records while they are submitted for approval until they are approved, except for one workflow in particular, coincidently the one I was busy investigating, the Sales Order Credit Limit Approval Workflow.

After comparing the Sales Order Credit Limit Approval Workflow to the rest of the other sales order workflows that were available I discovered that there were no record restrictions added to the Sales Order Credit Limit Approval Workflow template so when I created a workflow from the template and enable it, the system allowed me to submit the sales order for approval if the credit limit was exceeded but also allowed me to go and release the sales order regardless of whether the sales order approval request was yet to be approved, this was allowed because there were no record restrictions created for the record by the workflow.

I then added the response "Add Record Restriction" response to the "A customer credit limit is exceeded." event on the workflow to add the record restriction only when the credit limit has been exceeded

Next I added the "Remove Record Restriction" response just above the response that changes the document status to each of these events : "An approval request is approved.", "An approval request is rejected." and "An approval request for a sales document is canceled." to remove the restriction if the document was approved, rejected or canceled so that record can become editable again which solved the issue.

I was then able to submit a sales order that exceeded its credit limit and while it was still pending approval, I could not modify the record or release it without it having been approved first.