Overview
This article explains the value of access governance policies, what Torii provides in this area, and where to find each part of the feature. It's the starting point for the Access Governance guide; every other article links back here.
In many organizations, access decisions happen across many systems and over time. People join teams, change roles, take on temporary responsibilities, or keep access they no longer need. As a result, access drifts away from what the organization intended. This creates two common problems:
- Some users end up with more access than they should have.
- Some users are missing access they need to do their jobs.
Torii's Access Governance feature is designed to solve both. This gives admins a structured way to define access intent per app and account, and then surface deviations when actual access no longer matches that intent. It can even resolve the discovered deviations automatically for you.
What is access governance? Why is it important?
Access governance is the practice of defining who should have access to which apps and roles, then continuously monitoring for gaps between that intended access and what users actually have.
Access governance policies help teams improve security, strengthen compliance, and reduce manual overhead. They provide value in three main areas:
Clear access expectations
Admins define which groups of users should automatically have access, are allowed to have access, or should not have access to a given app role.
Continuous visibility
Torii continuously checks enabled policies and identifies users whose access is out of policy, so teams don't rely only on periodic reviews.
Faster investigation and remediation
When a deviation is found, Torii shows what happened and why, making it easier to understand the issue and decide what to do next. Torii can also fix deviations for you. See Automatically remediating access policy deviations.
Access Governance in Torii
Access Governance in Torii lets you govern access continuously instead of relying only on manual review. It gives you:
A central place to create and manage access governance policies
A centralized view of policy deviations across your organization, grouped by risk
You can use the feature to:
Define intended access for key apps and roles
Monitor for over-privileged and under-privileged users
Investigate deviations from one central place, starting with the highest-risk ones
Handle mover cases that need delayed privilege removal, using a grace period
Automatically assign tasks to app owners to fix deviations and follow up on them
Automatically remediate policy deviations and return users to their intended access with no manual effort, or remediate individual deviations on demand
Build a stronger access governance process over time
Access Governance is especially useful for teams that want clearer access standards, better visibility into access drift, and a more proactive security and compliance posture.
How it works
- Group-based policies. Groups segment users by attributes such as department, team, or location. You can use any groups Torii discovers form other sources, or create your own.
- Policies define what access they should have. A policy sets, for one app and account, which groups are Allowed, Birthright, or Denied each role or IdP group.
- Torii finds deviations. Active policies are evaluated on a recurring basis. Users whose access doesn't match are flagged as Role mismatch, Unauthorized access, or Missing access.
-
Deviations get resolved. Depending on the remediation level, Torii only sends a notification, opens a task for the app owner, or fixes the access automatically.
Key concepts
| Term | Meaning |
|---|---|
| Policy | The access rules for one app and account, evaluated by direct integration (app roles) or IdP group membership |
| Group | A reusable set of users defined by attribute filters, shared with the App Catalog |
| Access type | Allowed (may have access), Birthright (should have access), or Denied (must not have access) |
| Deviation | A user whose access doesn't match the policy |
| Remediation level | What Torii does about a deviation: None (alert only), Open task, or Automatic remediation |
| Grace period | Time a user keeps their previous access after a role or attribute change |
Articles in this guide
| Article | Read it when you want to |
|---|---|
| Configuring access governance policies | Create and manage policies and groups |
| Monitoring and resolving policy deviations | Review deviations, understand the deviation cards and emails, and fix issues |
| Access governance settings | Change app owner access, grace period, default remediation level, or deviation notifications |
| Automatically remediating access policy deviations | Let Torii fix deviations for you |
| Grace period | Understand how mover events are handled |
| Policy use case examples | See example policies to start from |
Permissions and availability
Access Governance is available only to customers with the Torii Identity module, on all user plans.
Access to the feature is controlled by a dedicated scope: Access Governance.