Overview

This article explains how to set up and manage access governance policies and groups. It's part of the Access Governance guide. 

• For what the feature does, how it works, and permissions, start with What is Access Governance?. 

• To monitor and fix users who are out of policy, see Monitoring and resolving policy deviations. 

• To change how the feature behaves across all policies, see Access governance settings.

• If you're looking for examples of how to set up governance policies, you can find a dedicated article here.

The Access Governance page

Access Governance has a dedicated page in Torii where admins can manage policies and review deviations. The page includes four tabs:

Policy Deviations 
A centralized table of users whose access does not match policy. See Monitoring and resolving policy deviations.

Grace Period 
A centralized table of users who keep temporary access during a job function change. You can read more about Torii's grace period here.

Governance Policies 
A table of all defined access policies.

Groups 
A shared groups experience used to define and manage the user groups referenced by policies. These groups are shared with the App Catalog.

To configure feature-wide settings, click Access governance settings at the top of the page. See Access governance settings. If you enabled automatic remediation, click Action log to see the actions Torii took automatically.

The Governance Policies tab

The Governance Policies tab is where admins create and manage policies for connected apps.

From this tab, you can:

• View all policies in one table
• Create, edit, or delete a policy
• Enable or disable monitoring for a policy
• Run policy monitoring manually

Each row in the table represents one policy. The table also shows the number of groups affected by the policy, the number of deviations found, the last policy evaluation time, and whether the policy is active. This makes it easy to see which apps are governed, which policies are enabled, and where issues are being detected.

Creating a policy

Here's an article that walks you through creating two governance policies.

To create a policy:

1. Click + New policy.
2. Under Governance scope, select the app you want to create a policy for.

3. Under Governance method, select how the app is governed:

   • Direct integration (role-based): select the app account to monitor. Torii evaluates access using the app's native roles and permissions.
   • IdP group-based access (group membership-based): select the relevant IdP and account to compare access to.

   Note: If the app does not have a connected integration, only IdP group-based access is available.

4. Under Access rules, add the rules that make up the policy:

   • Each rule applies to one role users can have in the selected app and account 
   • Each rule can apply to multiple groups, each with its own access type.
   • A policy can have any number of rules.
   • For IdP group-based policies, access types still apply, but instead of checking roles in the app, Torii checks membership in the configured IdP group.

   Note: Policy rules act as an allowlist. Any user discovered with app access that no rule applies to is considered out of policy (a deviation). Make sure to set rules for all app roles or relevant IdP groups before enabling the policy. App owners are the exception: by default, they are allowed any access to the apps they own. See Access governance settings.

    

The available access types are:

• Allowed: Users in the selected group are permitted to have this access.
• Birthright: Users in the selected group should automatically have this access.

• Denied: Users in the selected group must not have this access. Denied rules apply to app owners too. 

   

5. Under Enforcement settings, choose a Remediation level. By default, the policy uses the level set in Access governance settings (shown as Default configuration). To override it for this policy, choose:
   1. None: Torii monitors the policy for deviations but takes no action except for email alerts.
   2. Open task: Torii automatically opens a task for the app owner to fix discovered deviations.
   3. Automatic remediation: Torii tries to fix discovered deviations by adjusting the user's access to match the policy. If it can't find a safe action, or the action fails, it opens a task instead. Learn more about automatic remediation.
       
6. Click Review & Save.
7. Choose whether to save the policy as Inactive (save without turning it on) or Active (turn it on immediately), then click Confirm & save.

Important notes

• For direct integration policies, user access is reviewed at the app role level. For connected apps that don't provide role data, you can either upload user data manually or use the Any access option to govern general app access.
• For IdP group-based policies, user access is compared to the defined IdP groups. A user with access to the app (as reported by the IdP) who isn't in the correct IdP group is out of policy.
• Policy rules act as an allowlist. Any user discovered with app access that no rule applies to is out of policy, except app owners when Allow app owner access is on.
• A policy must include at least one fully defined group rule before it can be saved.
• If your app has roles that Torii didn't discover, you can create custom roles during policy configuration: open the Role dropdown and select + Create custom role.

• The same app and account can have only one role-based policy, but can have both a role-based policy and an IdP group-based policy. Combine them to monitor (and fix) issues with both IdP group membership and actual app role.

   

Best practices

• For non-integrated apps, you can upload a user file and then create a governance policy for the app. You can do the same with Google Sheet integrations and custom integrations (including data uploaded via Torii Sheets).
• If you govern access today using IdP groups (for integrated or non-integrated apps), use IdP group-based policies to match your current processes for these apps.
• Because policy rules act as allowlists, set rules for all app roles or relevant IdP groups before enabling the policy, to avoid incorrect deviations.
• If you're working with others on a complex policy, save it between updates but don't activate it until the configuration is final.
• Test your policy with the remediation level set to None. Once you're happy with the results, change it to Open task, and then to Automatic remediation once you're confident. See Automatically remediating access policy deviations for guidance.

Other actions in the Governance Policies tab

When you hover over a policy in the Governance Policies tab, you'll see additional actions:

• Edit policy: Edit an existing policy using the same flow as policy creation. Once a policy is created, you can't change the app and account it refers to.
• Delete policy: Deletes the policy completely. Any open deviations are marked as resolved.
• Evaluate now (active policies): Runs the policy evaluation immediately.

The Groups tab

The Groups tab is where users view and manage the groups used in Access Governance policies. These groups are also shared with the App Catalog.

Groups are the foundation of governance policy eligibility in Torii. They define which users a policy applies to based on their attributes, such as department, team, location, or any other user segment you want to govern. When you create a policy, you choose one or more groups and define what access the users in those groups should have for a specific app and account.

From the Groups tab, admins can:

• View existing groups
• Create, edit, and delete groups used in governance policies
• View the users in each group

This makes it easier to reuse consistent user segments across policies instead of redefining eligibility each time.

Creating a group

To create a group:

1. Click + Add group on the Groups tab.
2. In the sidebar that opens, name the new group.
3. Select filters to fine-tune the list of users in your group.
4. Preview the user list by expanding Users found.
5. Click Save.

You can also create groups directly from the policy configuration page using a similar experience.

Permissions and availability

Creating and editing policies and groups requires the Access Governance: Take Action scope.