Hi, Team,

If one has "Auto-approve requests when the requester is the approver" as "Yes" and a requester uses the on-behalf-of field with someone who approves the request, the request will be automatically approved.

This situation can be seen as a lack of security, can't it?

Besides setting this configuration to "No", is there a way to prevent this? 

Thanks.