A compliance-focused area, separate from day-to-day RBAC management, covering three related jobs: reviewing existing access grants, running scheduled recertification campaigns, and defining permission combinations that should never be held by the same person.
Pending reviews
A queue of individual access grants awaiting sign-off — for each one, Certify confirms the access is still appropriate, Revoke removes it.
Recertification campaigns
For a bulk sweep — "re-confirm everyone's access to X this quarter" — create a draft campaign and click Launch when ready. This pushes a batch of grants into the Pending Reviews queue for reviewers to work through, rather than relying on someone remembering to check access manually.
Segregation of duties
Define a rule as two roles or access levels that should never both be held by the same person — for example, someone who can create a vendor payment shouldn't also be able to approve it. Click + Add SOD Rule to define one; each rule can be individually enabled or disabled. If a new access request would violate an active rule, it's flagged and needs a documented override rather than going through silently.
Example
A quarterly access recertification campaign is launched for all Finance-adjacent roles. It drops forty pending grants into the review queue; a manager works through them, revoking access for two people who changed teams since the last review. Separately, an SOD rule blocks a new hire from being granted both "Budget Approver" and "Purchase Order Creator" at once — the request is flagged, and the admin has to explicitly document why an exception is warranted before it goes through.