Policy
The Policy object: rules that flag risky or non-compliant access, such as SoD.
A Policy defines rules that detect violations, most importantly separation-of-duties conflicts between incompatible entitlements or roles.
- What the Policy object represents
- Key attributes and relationships
- How it is created and maintained
- Where it appears in governance
The Policy object defines rules that detect risky or non-compliant access. The most important kind is the separation-of-duties (SoD) policy, which flags toxic combinations of entitlements or roles that no single person should hold, for example the ability to both create a vendor and pay that vendor.
Types of policy
- SoD policies: define conflicting sets of access; an identity holding items from both sides is in violation.
- Account/activity and other policies: detect other risk conditions your organisation cares about.
How policies are evaluated
Policies run during identity refresh, at access-request time, and within certifications. At request time a policy can prevent a conflicting grant or require an explicit exception approval; during refresh it detects existing violations and raises them for remediation.
Handling violations
When a violation is found, it is surfaced to the responsible owner, who either remediates (removes the conflicting access) or approves a documented, time-bound exception. That exception trail is itself audit evidence, showing that conflicts are consciously managed rather than ignored.
Why policy is central to compliance
SoD is exactly what SOX and similar frameworks scrutinise, because uncontrolled toxic combinations are how fraud happens. Defining SoD over your sensitive entitlements (especially in finance systems like SAP) and enforcing it at request time is one of the highest-value controls SailPoint provides.
Common pitfalls
- Detect-only policies with no remediation, findings that pile up unaddressed.
- Policies defined over poorly-modelled entitlements, producing noise.
- No exception process, forcing all-or-nothing outcomes instead of managed exceptions.