> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/administration-guide/caddie/overview.md).
# Caddie — Access Review Assistant overview
What Caddie — Access Review Assistant is, the four questions it answers for a reviewer, the seven blocks at a glance, where it appears, what it deliberately does not do, and where its data comes from.
This page is for anyone who has heard that reviewers now have a "Caddie" and wants to know what that means before reading anything else. It contains no settings and no procedures: the campaign owner's steps are on [Enable Caddie](/administration-guide/caddie/enable-caddie.md), and each block has a page of its own.
**On this page**
* [What Caddie is](#overview-what-it-is)
* [The four questions](#overview-four-questions)
* [The blocks at a glance](#overview-blocks)
* [Where it appears, and where it does not](#overview-where)
* [What it deliberately does not do](#overview-not)
* [Beta status and the switch](#overview-beta)
* [Where the data comes from, and what gets written](#overview-data)
* [What arrived with it, outside Caddie](#overview-arrived)
* [A worked example](#overview-worked-example)
## What Caddie is
Caddie — Access Review Assistant is a right-hand panel on the certification reviewer screens in SelfService. It opens from one row, a single person's grant of a single entitlement, and it gathers everything the platform already knows about that line into collapsible blocks written as sentences: who the person is, what the entitlement is, whether people like them hold it, what earlier campaigns decided, what would happen if it were revoked, and whom to ask when none of that settles it.
Its subtitle states the contract: *Read-only context about this line item. Caddie suggests nothing - the decision stays with you.* There is no recommendation, no score of its own, no button that certifies or revokes. It exists so that a reviewer with fifteen minutes and 300 rows can single out the ones that deserve a real look, and can write a justification that says more than "looks fine".
## The four questions
Every block answers one of four questions. If a future block does not, it does not belong in the panel.
| The reviewer asks | The block that answers | Read |
| ---------------------------------------- | --------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
| Who is this person, and what do they do? | **User information** | [The Caddie panel](/administration-guide/caddie/the-caddie-panel.md#block-user-information) |
| What is this thing I am approving? | **Entitlement information** | [The Caddie panel](/administration-guide/caddie/the-caddie-panel.md#block-entitlement-information) |
| Is this normal for someone like them? | **Peer comparison**, **Certification history**, **This entitlement across other users** | [Peer comparison](/administration-guide/caddie/peer-comparison.md), [Certification history](/administration-guide/caddie/certification-history.md) |
| What happens if I take it away? | **What happens if I revoke this?** | [What happens if I revoke this?](/administration-guide/caddie/revocation-impact.md) |
| None of that settled it. Who can I ask? | **Ask for help** | [Ask for help](/administration-guide/caddie/ask-for-help.md) |
## The blocks at a glance
The panel shows the blocks in this order. Every block starts collapsed and fetches nothing until it is expanded, so opening the panel costs the server nothing.
| Block, as titled on screen | What it reads | What it says when there is nothing |
| --------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------- |
| **User information** | The reviewed person, rendered through the campaign's user details template | *Nothing to show for this item.* |
| **Entitlement information** | The reviewed role or group, through the campaign's role or group details template | *Nothing to show for this item.* |
| **Peer comparison** | The Peer Rarity risk factor already scored on the item: how many people in the same unit or team hold the access | *Peer comparison is not available for this item.* |
| **Certification history** | Earlier campaigns in which this person's access to this entitlement was decided, newest first | *This access has not been reviewed for {name} in any previous campaign.* |
| **This entitlement across other users** | One anonymised sentence on how often the entitlement was revoked for its other holders | *There is not enough certification history for this entitlement to show a comparison.* |
| **What happens if I revoke this?** | A read-only prediction: when the access would end, which resources would be lost and kept, what happens to accounts, what would grant it back, the SoD outcome | Always says at least when the revocation would take effect, and what OpenIAM cannot see |
| **Ask for help** | Who can be asked about this item: the entitlement owner, the application owner, your manager, a campaign manager | *Unfortunately the system cannot identify any user to ask for help from.* |
Above the blocks, a header repeats the row: **User**, **Entitlement**, **Application** when the entitlement belongs to one, and the **Membership risk** pill when the campaign scores risk.
## Where it appears, and where it does not
Reviewers work in SelfService under **Governance → Access Reviews**, at `/selfservice-v2/uar/campaigns`. Inside a campaign they open a person to see that person's entitlements, or an entitlement to see its holders. On those two drill-down tables, rows the reviewer may still decide carry a **Caddie button**: a sparkles icon in the **Decision** column, right after the certify and revoke toggle, with the tooltip *Open Caddie — Access Review Assistant for this item*.
Caddie is a decision aid, so it is present exactly where a decision is still open:
| Situation | Caddie button |
| ----------------------------------------------------------------------------- | ----------------------------------------------------------------- |
| A row the reviewer has not yet submitted, at their own step | Shown |
| A pre-approved row still carrying the **Auto** chip and open to be overturned | Shown |
| A row whose decision at this step has been submitted | Gone |
| A row waiting for another reviewer's step | Never shown |
| The **UAR Manager View** that a campaign manager sees | Neither the button nor the panel, whatever the campaign's setting |
| The **Focus** view of a drill-down table | Shown on the same rows as in **List** |
| A campaign launched without Caddie | Nothing changes on the screen |
The panel is described control by control on [The Caddie panel](/administration-guide/caddie/the-caddie-panel.md).
## What it deliberately does not do
* **It does not recommend.** No sentence in any block says *should*, *safe*, *suspicious* or names a decision. Where a fact reads like advice, the fact is the reviewer's to weigh.
* **It does not act.** It cannot certify, revoke, delegate or comment. Every action stays on the row and in the decision cart.
* **It does not know more than the screen.** The information blocks render the same templates, fields and visibility rules as the user and entitlement details dialogs; the history and peer blocks read what the campaign and the risk engine already store. Nothing is computed that the platform could not show elsewhere.
* **It does not change the campaign.** Expanding blocks writes nothing to the item, the report or the audit trail. The one exception is sending a request for help, which records that help was requested and from what kind of person, and nothing more. See [Ask for help](/administration-guide/caddie/ask-for-help.md#help-recorded).
* **It does not name a manager in peer comparisons**, and it shows no other person's decision in the entitlement history, only counts. See [Peer comparison](/administration-guide/caddie/peer-comparison.md#peer-cohort) and [Certification history](/administration-guide/caddie/certification-history.md#history-entitlement-anonymised).
## Beta status and the switch
Caddie ships behind two switches on a certification's **Risk** tab: **Enable Beta Features**, which also unlocks the risk badges and the automation rules, and beneath it **Enable Caddie — Access Review Assistant**. Both are off by default. The setting is copied onto a campaign at launch and a running campaign keeps what it launched with, so switching Caddie on today changes the next campaign, not the one in flight. The procedure and the failure modes are on [Enable Caddie](/administration-guide/caddie/enable-caddie.md).
Beta means the panel and its blocks may change or be removed between releases, and that the wording of the sentences is still being validated with real reviewers. It does not mean the data is experimental: every block reads production data through the same access rules as the rest of the reviewer screen.
## Where the data comes from, and what gets written
| Block | Source | Writes |
| ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------- |
| User information, Entitlement information | The campaign's reviewer details templates, resolved against the live user, role or group | Nothing |
| Peer comparison | The `builtin.membership.peerRarity` contribution already stored on the review item, plus one lookup of the organization's name | Nothing |
| Certification history, This entitlement across other users | The review items and audit rows of earlier campaigns in the certification database | Nothing |
| What happens if I revoke this? | The live membership, the entitlement graph provisioning consults, the managed systems' `ON_DELETE` settings, business rules and the campaign's SoD arithmetic | Nothing; it predicts a revocation and never performs one |
| Ask for help | The owners recorded on the entitlement and the application, the reviewer's supervisors and the campaign's managers | One audit row per message sent, marked as a help request |
Every block fetches on first expand and reuses the answer for about a minute, so reopening the same row is free and a row is never fetched for because it is on screen. Each block's own page names the system properties that bound its work.
## What arrived with it, outside Caddie
Two additions to the reviewer screen shipped in the same release and are easy to mistake for Caddie blocks. Neither is beta, and neither needs a switch.
* **The History column and the audit trail sheet.** Every row of both drill-down tables carries a clock icon that opens everything already recorded against that item, oldest first: generated, opened, delegated, escalated, reassigned, auto-certified and withdrawn, decided, or asked about. See [Audit trail for a review item](/administration-guide/caddie/item-audit-trail.md).
* **The Campaign managers item** in the campaign header, beside the start and due dates, which lists the managers' names, email addresses and phone numbers. See [Contacting the campaign managers](/administration-guide/caddie/item-audit-trail.md#managers-item).
## A worked example
You are reviewing your team. Tom Becker's `Payments-Admin` row shows a red **98** and you click its sparkles icon. The header reads **User** Tom Becker, **Entitlement** `Payments-Admin`, **Application** Payments, **Membership risk** 98.
You expand **User information**: contractor, Engineering, with the organization since 60 days ago, manager: you. **Entitlement information**: *Full administrative access to the payments engine, including payment release*, owner Scott Nelson, application owner Scott Nelson, resources Payments Console and Payments Approvals, risk classification Critical. **Peer comparison**: *No other member of Engineering holds this access (14 people compared).* **Certification history**: *This access has not been reviewed for Tom Becker in any previous campaign.* **This entitlement across other users**: *This entitlement was revoked in the last 3 campaigns for 40% of the entitlement holders reviewed. (4 of 10 reviews)*
**What happens if I revoke this?** says: *The access would end on the day this review is completed. The membership is end-dated, not deleted. Tom Becker would lose access to: Payments Console, Payments Approvals. The account tbecker on Payments would be disabled. This access is set to expire on Nov 12, 2026 anyway. OpenIAM cannot tell whether this access is in use, or which application functions depend on it.*
Nothing here decided for you. But you now know the grant is unique in his team, has never been confirmed by anyone, was given directly rather than requested, and will end itself in seven weeks. You can revoke with a one-line note, or open **Ask for help** and ask Scott Nelson whether the contract needs it, without either choice counting as a decision until you submit.
Maria Rossi's `Finance-Reports-Read` tells the opposite story in the same blocks: common in Finance, certified twice before, never revoked for anyone, and revoking it would remove nothing because `Finance-Controllers` grants the same dashboard. Certify, and move on.
## Related
* [Enable Caddie](/administration-guide/caddie/enable-caddie.md) — the two switches and the properties that tune the blocks
* [The Caddie panel](/administration-guide/caddie/the-caddie-panel.md) — the button, the header and the two information blocks
* [Reading risk on the reviewer screen](/administration-guide/risk/reviewer-experience.md) — the pill the header repeats and the counts on a row
* [What your reviewers see](/administration-guide/governance/certification/the-reviewer-experience.md) — the cart, the bulk gates and the rest of the screen
*Applies to OpenIAM 2026.9.2. Last reviewed 23 September 2026.*
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.openiam.com/administration-guide/caddie/overview.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.