Quick reviews¶
If you'd like Permission Assist to help with the review, you can select one or more pre-approval condition options to determine whether an item is eligible for pre-approval.
When an item is pre-approved, it means Permission Assist has analyzed the item according to both the system criteria (built into Permission Assist) and the selected criteria (the options described below) and has determined the item meets that criteria.
Note
A reviewer can remove the pre-approval status at any time by selecting the Remove Pre-approval button within the detail panel.
Note
The following criteria must be met for an item to be eligible for pre-approval. These are required by Permission Assist and cannot be changed:
- The application user must have been reviewed manually at least one time (pre-approvals are not allowed during the first review)
- The application user must be active. Disabled users cannot be pre-approved
- The application user must have a matched identity
- The matched identity must be active. Users associated with disabled or removed identities cannot be pre-approved
Each option you select will be an additional requirement that must be met for an item to be eligible for pre-approval. For example, if you select both the "Permissions have not changed..." and the "No permissions are overprivileged..." options, then the item cannot be pre-approved if either the user has any new permissions or if the user's permissions exceed the permissions allowed by their associated access models.
Pre-approval condition options¶
| Option | Description |
|---|---|
| The user/group was approved in the previous review | When this option is selected, the review item must have been approved by all required reviewers in the previous review. If the item was flagged and sent to remediation, it cannot be pre-approved |
| Permissions have not changed since the previous review | When this option is selected, the user's permissions must be exactly the same as in the previous review. If the user has any new or changed permissions, the item cannot be pre-approved |
| No permissions are underprivileged according to the access models | When this option is selected, the user must have all of the permissions that are allowed according to the associated access models. If the user is missing permissions that the access models allow, the item cannot be pre-approved |
| No permissions are overprivileged according to the access models | When this option is selected, the user's permissions cannot exceed what is allowed according to the associated access models. If the user has more permissions than the access models allow, the item cannot be pre-approved |