> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/administration-guide/caddie.md). # Caddie — Access Review Assistant Caddie — Access Review Assistant: a read-only panel that gives a reviewer the context behind one line of access, how a campaign owner switches it on, what each block tells the reviewer, and the audit A certification reviewer is a manager or an application owner, not a risk specialist. They are handed a list of access grants and asked to certify or revoke each one, usually under a deadline and often hundreds of rows at a time. Almost everything that would make a decision defensible is somewhere else: who the person is, what the entitlement actually grants, whether it has been reviewed before, whether anyone like them holds it, and what would happen if it were taken away. The predictable result is rubber-stamping. **Caddie — Access Review Assistant** puts that context beside the decision. It is a read-only panel that opens from any row a reviewer still has to decide, and it answers four questions about that one line: who is this person, what is this thing, is this normal for someone like them, and what happens if I take it away. It recommends nothing and decides nothing. Certify and revoke stay on the row, exactly as before. This section explains all of it, for the campaign owner who switches it on and for the reviewer who reads it. It also covers the **audit trail** every review item now carries in the reviewer interface, which arrived alongside Caddie and is available to every campaign, Caddie or not. {% hint style="warning" %} Caddie is a **beta feature**. It appears only in campaigns launched from a certification with both **Enable Beta Features** and **Enable Caddie — Access Review Assistant** switched on, and it may change between releases. The [audit trail](/administration-guide/caddie/item-audit-trail.md) is not beta and needs no switch. {% endhint %} ## Start here | If you are… | Read | | --------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Anyone who has just heard of Caddie | [Caddie — Access Review Assistant overview](/administration-guide/caddie/overview.md) — what it is, the four questions, the blocks at a glance, and what it deliberately does not do | | A campaign or compliance owner switching it on | [Enable Caddie](/administration-guide/caddie/enable-caddie.md) — the two switches on the Risk tab, how the value reaches a campaign, the system properties that tune the blocks | | An administrator deciding what reviewers see about a user or an entitlement | [Reviewer details templates](/administration-guide/caddie/reviewer-details-templates.md) — the three page templates a certification names, the shipped defaults field by field, and how to build your own | | A reviewer opening the panel for the first time | [The Caddie panel](/administration-guide/caddie/the-caddie-panel.md) — the button, the header, and the User information and Entitlement information blocks | | A reviewer asking "has this been decided before?" | [Certification history](/administration-guide/caddie/certification-history.md) — this user's past decisions on this access, and how the entitlement fares across everyone else | | A reviewer asking "is this normal?" | [Peer comparison](/administration-guide/caddie/peer-comparison.md) — how many people in the same unit or team hold the same access | | A reviewer asking "what breaks if I revoke it?" | [What happens if I revoke this?](/administration-guide/caddie/revocation-impact.md) — the resources lost and kept, the accounts, the rules that would grant it back, the SoD outcome | | A reviewer who cannot decide | [Ask for help](/administration-guide/caddie/ask-for-help.md) — writing to the entitlement owner, the application owner, your manager or a campaign manager without that counting as a decision | | Anyone asking "what has already happened to this line?" | [Audit trail for a review item](/administration-guide/caddie/item-audit-trail.md) — the History column, the sheet it opens, every event it can show, and the Campaign managers contact card | | Anyone whose block says there is nothing to show | [Caddie troubleshooting](/administration-guide/caddie/troubleshooting.md) — nobody to ask for help, not enough history, no peer data, and what to change | Two files in this folder are not articles. `anchors.json` maps product UI elements to the sections here and is a build input for the frontend, so editing it is a product change; see the note at the top of this file. `_OPEN-QUESTIONS.md` lists what could not be confirmed when these pages were written. ## The example that runs through every page These pages reuse the people and entitlements of the [Risk management](/administration-guide/risk.md) section, so the numbers agree from one section to the next. * **Maria Rossi** — a Finance analyst, three years in the company, stable access. Her `Finance-Reports-Read` membership scores 37 (Medium). * **Tom Becker** — a contractor in Engineering on a 60-day contract, with broad access granted outside the normal process. His `Payments-Admin` membership scores 98 (Critical). * **`Payments-Admin`** — an entitlement in the **Payments** application that can move money. Risk level Critical. Owned by Scott Nelson, who also owns the application. * **`Finance-Reports-Read`** — a reporting entitlement in the **Finance BI** application that can only open a dashboard. Risk level Low. Owned by the `Finance-Controllers` group. You, the reviewer, are Tom's and Maria's manager, working a user certification with 300 rows and a deadline on Friday. ## Glossary | Term | Meaning | | -------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | | Caddie — Access Review Assistant | The read-only panel that opens from a review row and gathers context about that one line item. Beta | | Caddie button | The sparkles icon in the **Decision** column of a row the reviewer may still decide. Opens the panel | | Block | One collapsible section of the panel. Seven ship. Each fetches its data only when first expanded | | Line item, review item | One person's grant of one entitlement, as one row of a campaign. One `ACCESS_REVIEW_ITEM` | | Reviewer details template | The page template a certification names for user, role and group details. Drives the details dialogs and the two information blocks | | Certification history | What earlier campaigns decided about this exact access for this person | | Peer comparison | How many people in the same organization unit or team hold the same access, from the Peer Rarity risk factor | | Revocation impact | What revoking this line would do: resources lost and kept, accounts, rules that would grant it back, the SoD outcome | | Ask for help | A message to someone who can answer, written by the product, edited and sent by the reviewer. Recorded as a help request, not a decision | | Audit trail | Everything already recorded against one review item, shown oldest first from the **History** column. Not beta | | Campaign managers | The people listed as **Manager of Access Review** on the certification. Reviewers can read their contact details from the campaign header | | Beta features | The certification switch that unlocks the risk badges, the automation rules and Caddie for campaigns launched from it | ## Related * [Access certification](/administration-guide/governance/certification.md) — the campaigns Caddie lives in * [What your reviewers see](/administration-guide/governance/certification/the-reviewer-experience.md) — the rest of the reviewer screen * [Reading risk on the reviewer screen](/administration-guide/risk/reviewer-experience.md) — the risk pill the panel header repeats * [Access reviews](/end-user-guide-for-selfservice/access-reviews.md) — the reviewer's own guide *Applies to OpenIAM 2026.9.2. Last reviewed 16 October 2026.* --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.openiam.com/administration-guide/caddie.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.