> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/administration-guide/caddie/enable-caddie.md).
# Enable Caddie — Access Review Assistant
Switch Caddie — Access Review Assistant on for a certification — the two switches on the Risk tab, how the value reaches a campaign, what to check after launch, and the system properties that tune eac
## What this is, and when you need it
This page is for the campaign owner or compliance owner who configures certifications. It switches Caddie — Access Review Assistant on for one certification, explains when the change reaches reviewers, and lists the system properties that bound what the blocks do. If you want to know what Caddie is before switching it on, read the [overview](/administration-guide/caddie/overview.md) first. If you want to change *what* the two information blocks show about a user or an entitlement, that is a different setting: [Reviewer details templates](/administration-guide/caddie/reviewer-details-templates.md).
## At a glance
| Setting | Where | Default | Reaches a campaign |
| ------------------------------------------- | ------------------------------------------------------------ | --------------------------------------- | ------------------------------------------------------------------ |
| **Enable Beta Features** | Certification → **Risk** tab | Off | Copied at launch |
| **Enable Caddie — Access Review Assistant** | Certification → **Risk** tab, directly beneath Beta features | Off; disabled until Beta features is on | Copied at launch, and only when Beta features is on at that moment |
| Reviewer details templates | Certification → **Configuration** tab, last section | The three shipped templates | Copied at launch |
| Block limits and windows | System properties `org.openiam.cert.caddie.*` | See [below](#enable-properties) | Read live, per request |
## Before you begin
* Administrator access to the Webconsole with the **Access Certification** menu.
* A decision that reviewers of the next campaign may see beta functionality. Enabling Beta features also switches on the risk badges, the factor explanations and the **Automation Rules** block for that certification; see [Enable Beta Features](/administration-guide/risk/certification.md#cert-beta-features).
* Reviewers who use the current SelfService reviewer screens, at `/selfservice-v2/uar/campaigns`. The previous-generation screens have no Caddie.
* Optional but recommended: risk scoring configured, so that the panel header shows the **Membership risk** pill and the **Peer comparison** block has a Peer Rarity result to read. See [Risk management](/administration-guide/risk.md).
## Switch it on
{% stepper %}
{% step %}
Go to Webconsole → **Access Control** → **Access Certification** and open the certification.
{% endstep %}
{% step %}
Open the **Risk** tab. It is the second tab, after **Configurations**.
{% endstep %}
{% step %}
Switch on **Enable Beta Features**. A banner appears: *Beta features are still being validated and may change or be removed. Enable them only for campaigns where reviewers are prepared to see experimental Risk Manager functionality.*
{% endstep %}
{% step %}
Switch on **Enable Caddie — Access Review Assistant**, directly beneath it. The control's description reads: *Adds a Caddie panel to each line item on the reviewer screens with read-only user and entitlement information. Requires Beta features; it is switched off automatically when Beta features are off.*
{% endstep %}
{% step %}
Choose **Save**.
{% endstep %}
{% endstepper %}
### Enable Beta Features first
The Caddie switch is disabled and shows off while Beta features is off. Turning Beta features off again clears Caddie as well, and also switches off auto-certification and clears its settings. The server enforces the same rule: however a certification is saved, from the Webconsole, through the REST API or by message, a certification with Beta features off is stored with Caddie off, whatever the request carried.
### How the value reaches a campaign
* The setting is saved on the certification and **copied onto each campaign when it launches**, and only when Beta features is on at that moment. The campaign row carries it as `CADDIE_ENABLED`.
* **A running campaign keeps what it launched with.** Ticking the box today adds nothing to a campaign already in flight, and unticking it removes nothing from one.
* With Caddie off, which is the default, nothing else changes. The user and entitlement details dialogs keep working in every campaign, Caddie or not.
## What reviewers get
| Block | Question it answers | Page |
| ---------------------------------------------------------- | --------------------------------------- | ----------------------------------------------------------------------------------- |
| User information, Entitlement information | Who is this person, what is this thing | [The Caddie panel](/administration-guide/caddie/the-caddie-panel.md) |
| Peer comparison | Is this normal for someone like them | [Peer comparison](/administration-guide/caddie/peer-comparison.md) |
| Certification history, This entitlement across other users | Has this been decided before, and how | [Certification history](/administration-guide/caddie/certification-history.md) |
| What happens if I revoke this? | What happens if I take it away | [What happens if I revoke this?](/administration-guide/caddie/revocation-impact.md) |
| Ask for help | Who can answer when the reviewer cannot | [Ask for help](/administration-guide/caddie/ask-for-help.md) |
Brief reviewers that the button sits in the **Decision** column, that it appears only while a decision is still open, and that the panel never decides for them. The reviewer-facing description is in [Access reviews](/end-user-guide-for-selfservice/access-reviews.md#the-caddie-panel).
## Verification
1. Preview and launch a campaign from the certification, as usual: [Preview and launch a campaign](/administration-guide/governance/certification/preview-and-launch.md).
2. Sign in to SelfService as one of its reviewers, open the campaign and open any person or entitlement. Each undecided row shows a sparkles icon in the **Decision** column, and the icon's tooltip reads *Open Caddie — Access Review Assistant for this item*.
3. Click it. The panel opens on the right, titled **Caddie — Access Review Assistant**, with the row's user, entitlement and application in its header and seven collapsed blocks beneath.
If you can query the certification database, `CAMPAIGN.CADDIE_ENABLED` reads `Y` for the new campaign and `BETA_FEATURES_ENABLED` reads `Y` as well.
## When it goes wrong
| Symptom | Likely cause |
| --------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| The Caddie switch is disabled | Beta features is off. Switch it on first |
| Saved with both switches on, but the campaign shows no button | The campaign was launched before the change, or Beta features was off at launch. Only campaigns launched afterwards carry the setting |
| The button is missing on some rows but present on others | Those rows are already submitted at this step, or wait for another reviewer's step. Caddie appears only where a decision is still open |
| A campaign manager reports no Caddie anywhere | Expected. The manager's read-only **UAR Manager View** shows neither the button nor the panel |
| A block reads *This information could not be loaded* | The reviewer is not a current or past reviewer of that user or entitlement in this campaign, so the request was refused; or the service behind the block is down. **Retry** first; then check the selfservice and certification-manager logs |
| **User information** or **Entitlement information** reads *No details template is configured for this campaign* | The template the campaign launched with, and the shipped default, are both missing. See [When a template is missing](/administration-guide/caddie/reviewer-details-templates.md#templates-missing) |
| **Peer comparison** reads *not available* on every row | The Peer Rarity factor is not attached to the risk policy, or the campaign predates it. See [Peer comparison](/administration-guide/caddie/peer-comparison.md#peer-not-available) |
## Roll it back
Switch **Enable Caddie — Access Review Assistant** off and save. Campaigns launched from then on have no Caddie. Campaigns already running keep it until they end; the only lever on a live campaign is to expire it, as for every other setting copied at launch. Switching **Enable Beta Features** off removes Caddie too, and the risk badges and automation rules with it.
## System properties that tune the blocks
All of these are read live, so a change applies to the next request without a restart or a new campaign. Edit them under [System configuration](/administration-guide/platform/system-configuration.md).
| Property | Default | What it bounds |
| -------------------------------------------------- | ------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
| `org.openiam.cert.caddie.history.minPopulation` | `5` | The fewest reviews **This entitlement across other users** needs before it shows a percentage. Below it, the block says there is not enough history |
| `org.openiam.cert.caddie.history.maxCampaigns` | `5` | How many recent campaigns that sentence looks across |
| `org.openiam.cert.caddie.help.maxRecipients` | `25` | The most people one **Ask for help** option may address. A larger owner group is trimmed to this many, and the reviewer is told |
| `org.openiam.cert.caddie.help.ownerCacheSeconds` | `300` | How long a resolved entitlement owner is reused before being looked up again. Capped at five minutes |
| `org.openiam.cert.caddie.impact.timeoutMs` | `5000` | How long **What happens if I revoke this?** may spend on the entitlement-graph difference before it reports a partial answer |
| `org.openiam.cert.caddie.impact.parallelism` | `8` | How many graph traversals may run at once for one expand of that block |
| `org.openiam.cert.caddie.impact.maxResources` | `50` | The most resources either the lost or the kept list carries before the block says it was trimmed |
| `org.openiam.cert.caddie.impact.graphCacheSeconds` | `120` | How long an entitlement's resource set is reused before being read again. Capped at five minutes |
Two properties outside the `caddie` namespace also shape what reviewers read:
| Property | Default | Effect |
| ------------------------------------------------ | ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `org.openiam.workflow.termination.access.remove` | off | Whether a revocation end-dates the membership (off) or deletes it (on). The first sentence of **What happens if I revoke this?** reports whichever applies |
| `org.openiam.webconsole.defaultBaseDomain` | empty | The domain used to build the link back to the item in an **Ask for help** message. While it is empty, no link is included |
The wording of the help message comes from the mail template `UAR_CADDIE_ASK_FOR_HELP`; see [Ask for help](/administration-guide/caddie/ask-for-help.md#help-template).
## System properties for Focus
Two properties set when the reasons in the reviewer's [Focus view](/administration-guide/risk/reviewer-experience.md#reviewer-focus-reasons) appear. They are read when the certification-manager service starts, so restart it after a change.
| Property | Default | What it sets |
| ---------------------------------------------- | ------- | -------------------------------------------------------------------------------------------------------------- |
| `org.openiam.cert.focus.grantAgeDays` | `365` | How old, in days, a never-reviewed grant must be before it shows *Never reviewed* |
| `org.openiam.cert.focus.revocationRatePercent` | `25` | The share of other holders' reviews that must have been revocations before an item shows *Others revoked this* |
The *Others revoked this* reason also respects `org.openiam.cert.caddie.history.minPopulation` and `org.openiam.cert.caddie.history.maxCampaigns` above, so it never shows a rate Caddie would refuse to show. The *No sign-in* reason uses the dormancy threshold set on the Dormant Identity factor of your risk policy, not a property of its own.
## Related
* [Access certification and risk](/administration-guide/risk/certification.md) — the rest of the Risk tab: the threshold, the band reference and the automation rules
* [Reviewer details templates](/administration-guide/caddie/reviewer-details-templates.md) — what the two information blocks show
* [Preview and launch a campaign](/administration-guide/governance/certification/preview-and-launch.md) — how a setting becomes a campaign
* [What your reviewers see](/administration-guide/governance/certification/the-reviewer-experience.md) — every other setting that changes the reviewer's screen
*Applies to OpenIAM 2026.9.2. Last reviewed 23 September 2026.*
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.openiam.com/administration-guide/caddie/enable-caddie.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
