> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/administration-guide/access.md).

# Model and grant access

Entitlement management in OpenIAM — model access with roles, groups, organizations and resources, grant it automatically with business rules, and route requests with content providers.

## What this is, and when you need it

This section covers the objects that decide *what a person is entitled to*: roles, groups, organizations, resources, access rights and the entitlements that connect them. It is OpenIAM's **entitlement management** layer, and it is where a model of least privilege is either expressed or lost. It also covers the two engines that operate on them — business rules, which grant and revoke from identity data, and content providers, which decide which URLs exist and what protects them.

It does not cover delivery to a managed system. An entitlement in OpenIAM becomes an account or a group membership in Active Directory through a managed system and a policy map — see [Connect applications and automate lifecycle](/administration-guide/lifecycle.md).

## Choose your outcome

| I want to…                                                                                                 | Go to                                                                                                                                       |
| ---------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
| Understand roles versus groups versus organizations versus resources, and how effective access is computed | [The access model](/administration-guide/access/access-model.md)                                                                            |
| Create a role                                                                                              | [Create a role](/administration-guide/access/create-a-role.md)                                                                              |
| Add or remove members, nest roles, set effective dates, compare two roles                                  | [Manage roles and groups](/administration-guide/access/manage-roles-and-groups.md)                                                          |
| Look up a field on the role or group form, or the entitlement CSV columns                                  | [Role and group field reference](/administration-guide/access/manage-roles-and-groups/role-and-group-reference.md)                          |
| Build and maintain a role catalog using OpenIAM's own tooling                                              | [Role engineering and maintenance](/administration-guide/access/role-engineering.md)                                                        |
| Understand resource types, or model an organization hierarchy                                              | [Resources and organizations](/administration-guide/access/resources-and-organizations.md)                                                  |
| Load a whole organization tree from a CSV file                                                             | [Import an organization hierarchy from CSV](/administration-guide/access/resources-and-organizations/import-organizations-from-csv.md)      |
| A user holds the role and still cannot reach what it entitles                                              | [Rebuild the authorization graph](/administration-guide/operations/rebuild-the-authorization-graph.md)                                      |
| Look up an enumerated value, a property key or an audit action these pages cite                            | [Reference](/administration-guide/reference.md)                                                                                             |
| Grant or revoke access automatically from identity attributes                                              | [Build a business rule](/administration-guide/access/business-rules.md)                                                                     |
| Look up a business-rule action's exact blast radius, or copy a working pattern                             | [Business rule reference](/administration-guide/access/business-rules/business-rule-reference.md)                                           |
| Work out which content provider and URI pattern answer a URL, and what protects it                         | [Content providers and URI patterns](/administration-guide/access/content-providers-and-uri-patterns.md)                                    |
| Look up a field on either of those two screens, or a shipped default                                       | [Content provider and URI pattern reference](/administration-guide/access/content-providers-and-uri-patterns/content-provider-reference.md) |

## Start here

If you are new to this section, read it in this order: [The access model](/administration-guide/access/access-model.md), [Create a role](/administration-guide/access/create-a-role.md), [Manage roles and groups](/administration-guide/access/manage-roles-and-groups.md), [Build a business rule](/administration-guide/access/business-rules.md). The first page decides which container object you should be using; the last one is how a container stops being a manual grant.

Adjacent tasks that live elsewhere:

* Grant or revoke on one user — [Grant and revoke access](/administration-guide/identities/grant-and-revoke-access.md).
* Make access requestable with an approval flow — [Configure requests and approvals](/administration-guide/requests.md).
* Review access, score risk, detect segregation-of-duties conflicts — [Govern access](/administration-guide/governance.md).
* Grant on hire — [Grant birthright access](/administration-guide/lifecycle/birthright-access.md); remove on termination — [Disable leavers automatically on their end date](/administration-guide/lifecycle/disable-leavers-automatically.md).
* Publish an application behind the proxy, inject identity into it, or rewrite its responses — [Administer the Access Gateway](/administration-guide/gateway.md).

## Three things that catch people out

**Business-rule recalculation is not scheduled.** `PERFORM_BR_REPROVISION` ships **disabled**, seeded with cron `0 0 0 * * ?`. A rule change reaches its whole population overnight whether or not anyone runs a recalculation. See [Build a business rule](/administration-guide/access/business-rules.md).

**Membership end dates are not self-enforcing.** The batch task that revokes expired access, `AUTO_REVOCATION` (cron `0 0 20 * * ?`, bean `revocationOfEndDatedAccess`), ships **disabled**. An end date you set today is recorded and displayed but nothing acts on it until you enable that task. See [Shipped batch tasks](/administration-guide/reference/shipped-batch-tasks.md).

**Adding one organization affiliation can add several.** `org.openiam.automatic.organization.hierarchy.assignment.enabled` ships `true`, so saving a user with an affiliation to a child organization also affiliates them to every ancestor, recursively. See [Resources and organizations](/administration-guide/access/resources-and-organizations.md).

## Before you change anything

Read [Change configuration safely](/administration-guide/start/change-safely.md) once. Role, group and business-rule changes have a wide blast radius by nature: they act on populations, not on one person. Every shipped default named in this section can be read back on your own system, and you should, because an upgraded deployment often differs from a fresh one — property values are at **Administration → System Configuration**, and the catalogues are in [Reference](/administration-guide/reference.md).

*Applies to OpenIAM 2026.8.1. Last reviewed 7 August 2026.*


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.openiam.com/administration-guide/access.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.