Policy
Quick answer
A Policy defines rules that detect violations, most importantly separation-of-duties conflicts between incompatible entitlements or roles.
Key takeaways
- What the Policy object represents
- Key attributes and relationships
- How it is created and maintained
- Where it appears in governance
The Policy object defines rules that detect risky or non-compliant access. The most important kind is the separation-of-duties (SoD) policy, which flags toxic combinations of entitlements or roles that no single person should hold, for example the ability to both create a vendor and pay that vendor.
Types of policy
- SoD policies: define conflicting sets of access; an identity holding items from both sides is in violation.
- Account/activity and other policies: detect other risk conditions your organisation cares about.
How policies are evaluated
Policies run during identity refresh, at access-request time, and within certifications. At request time a policy can prevent a conflicting grant or require an explicit exception approval; during refresh it detects existing violations and raises them for remediation.
Handling violations
When a violation is found, it is surfaced to the responsible owner, who either remediates (removes the conflicting access) or approves a documented, time-bound exception. That exception trail is itself audit evidence, showing that conflicts are consciously managed rather than ignored.
Why policy is central to compliance
SoD is exactly what SOX and similar frameworks scrutinise, because uncontrolled toxic combinations are how fraud happens. Defining SoD over your sensitive entitlements (especially in finance systems like SAP) and enforcing it at request time is one of the highest-value controls SailPoint provides.
Common pitfalls
- Detect-only policies with no remediation, findings that pile up unaddressed.
- Policies defined over poorly-modelled entitlements, producing noise.
- No exception process, forcing all-or-nothing outcomes instead of managed exceptions.
Want to learn this properly?
Our live, instructor-led SailPoint Training covers this hands-on, with real projects and a certification path.
Check your understanding
What does a Policy do?
- A. Preventing one person from both creating and paying a vendor.
- B. Defines rules that flag risky or non-compliant access, especially SoD conflicts.
- C. During refresh, access requests and certifications.
Show answer
B. Defines rules that flag risky or non-compliant access, especially SoD conflicts.
Defines rules that flag risky or non-compliant access, especially SoD conflicts.
Give an SoD example.
- A. Preventing one person from both creating and paying a vendor.
- B. Defines rules that flag risky or non-compliant access, especially SoD conflicts.
- C. During refresh, access requests and certifications.
Show answer
A. Preventing one person from both creating and paying a vendor.
Preventing one person from both creating and paying a vendor.
When are policies evaluated?
- A. Defines rules that flag risky or non-compliant access, especially SoD conflicts.
- B. During refresh, access requests and certifications.
- C. Preventing one person from both creating and paying a vendor.
Show answer
B. During refresh, access requests and certifications.
During refresh, access requests and certifications.