Risk mitigation path before role owner approval in GRC 10 Access request

Hi Friends,

We are implementing ARM and we are facing issues with the design. Please help.

We want the workflow as below:

1) Access Request submitted

2) If there are SOD violations, route it to Security/point of contact. Security will mitigate and either send back to role owner approver or

auto provisioning

3) If No SOD, it should goto role owner approval stage and then auto provisioning

If the request is for role remove, it should go to auto provisioning without approvals but notify the role owner.

Please help me.

Thanks,