Overview
Access governance settings control how Access Governance behaves across all your policies. To open them, go to the Access Governance page and click Access governance settings.
This article is part of the Access Governance guide. For an overview of the feature, start with What is Access Governance?.
The page has four settings:
- Allow app owner access: whether app owners can be flagged on the apps they own
- Grace period: how long users keep their previous access after a role or attribute change
- Remediation level: what Torii does by default when it finds a deviation
- Deviation notifications: which deviations are included in deviation emails
Allow app owner access
When this setting is on, app owners are automatically allowed access to the apps they own, so they are never flagged for Unauthorized access or Role mismatch on those apps. This setting is on by default.
It applies to:
- Both the primary app owner and everyone listed in All app owners
- Both direct integration and IdP group-based policies
Keep in mind:
- Denied rules still apply. If an owner is in a group with a Denied rule for the app, they're still flagged.
- Missing access still applies. If an owner should have Birthright access to the app but doesn't, they're still flagged with Missing access.
- Changes apply to existing deviations. Turning this setting on or off re-evaluates all active policies, and deviations update within a few minutes.
To flag app owners like any other user, turn this setting off.
Grace period
A grace period is a set time frame that starts when a user no longer meets an access policy because their attributes changed (a "mover" event). Instead of immediately marking the user as out of policy, Torii keeps them in policy until the grace period ends.
This lets employees who move between roles, departments, or projects keep their previous access long enough to finish, clean up, or hand off their current work. They still get the access their new position requires right away.
Users in a grace period appear on the Grace Period tab of the Access Governance page. You can read more about Torii's grace period here.
This settings allows you to configure whether to allow a grace period for app access or not, and the duration of such period.
Remediation level
The remediation level sets what Torii does when a policy finds a deviation. The level you choose here is the default for every policy set to Default configuration. You can override it for a single policy in that policy's Enforcement settings.
- None: Torii monitors policies for deviations but takes no action except for email notifications.
- Open task: Torii automatically opens a task for the app owner to fix discovered deviations.
- Automatic remediation: Torii tries to fix discovered deviations by adjusting the user's access to match the policy. If it can't find a safe action, or the action fails, it opens a task instead. [Learn more about automatic remediation]
We recommend starting with None, then moving to Open task, and finally to Automatic remediation once you're confident in your policies' results.
Deviation notifications
Choose which deviations are included in the recurring deviation email. You can select any combination of:
| Option | Includes |
|---|---|
| Critical deviations (default) | Deviations involving elevated permissions in a sensitive system |
| Deviations in sensitive systems | Deviations in your IdP, HRMS, expense, and contract management integrations |
| Unauthorized elevated permissions | Deviations involving a role whose name contains "admin" or "owner" |
| All deviations | Every open deviation |
These are the same categories as the cards on the Policy Deviations tab. See Monitoring and resolving policy deviations.
This setting controls which deviations the email includes (to all recipients). How often you receive it is set separately by each admin in the notification settings page.
When setting changes take effect
- Allow app owner access: re-evaluates all active policies, so existing deviations update within a few minutes.
- Grace period and Remediation level: affect only future changes. They don't retroactively update current deviations.
-
Deviation notifications: apply from the next deviation email.
Permissions
Access governance settings are part of the Access Governance feature, available to customers with the Torii Identity module. changing Access governance settings requires the Access Governance: Take Action scope.