Authorization

Authorization decides what an authenticated identity is permitted to access or do. Abbreviated AuthZ, it is the half of access management SailPoint exists to govern. Authentication proves who you are; authorization determines the reach of that proven identity, and keeping that reach correct, minimal and auditable is the entire point of an identity governance platform.

SailPoint expresses authorization as a hierarchy of increasingly business-meaningful units:

• Entitlement: the atomic unit, a single permission on a single system, such as membership in the AD group CN=Finance-RW, an SAP role, or a database privilege.
• Managed Attribute: an entitlement that has been enriched with an owner, description and classification so it is meaningful to a human reviewer.
• Role (Bundle): a curated collection of entitlements that maps to a job function, for example a "Branch Teller" role bundling the dozen entitlements a teller needs.

Assigning a role grants all of its entitlements; removing the role revokes them. This is what makes access manageable: instead of tracking thousands of individual permissions, you reason about a few hundred roles that mean something to the business.

Authorization data enters an identity by several routes, and understanding which is which matters for governance:

• Birthright / automatic: assignment rules grant baseline access to everyone matching a condition, e.g. every full-time employee gets email and the corporate intranet.
• Requested: a user asks for access through the request catalogue; it is approved and provisioned.
• Role-based: a role's membership criteria match an identity's attributes and the role (and its entitlements) attach automatically.
• Detected / out-of-band: access that was granted directly in the target system and discovered by aggregation. This is the access governance most wants to catch and review.

Any directory can store permissions. What distinguishes SailPoint is that it continuously governs them:

• Policy evaluates access for separation-of-duties conflicts and other risk, flagging violations for remediation.
• Certifications force owners and managers to periodically re-attest that access is still appropriate, revoking what is not.
• Provisioning enforces every decision in the actual target systems, so what SailPoint says a person should have and what they really have stay aligned.

Together these keep authorization correct over time, which is the hard part. Access is easy to grant and easy to forget; the value of governance is in relentlessly pulling the environment back toward "only the access that is currently justified".

Most deployments blend models. Role-based access control (RBAC) provides the stable backbone; attribute-based access control (ABAC), expressed through assignment rules and role membership criteria, adds dynamic, attribute-driven grants that adjust automatically as people move. Designing the right split between the two is one of the central architecture decisions in a programme.

• Entitlement sprawl: governing thousands of raw entitlements instead of grouping them into roles makes certifications meaningless.
• Undescribed entitlements: reviewers cannot attest to APP_GRP_0472; enrich entitlements as Managed Attributes with plain-language descriptions and owners.
• Ignoring detected access: access granted directly in target systems is exactly where risk hides, so aggregate and review it.