> For the complete documentation index, see [llms.txt](https://docs.veza.com/4yItIzMvkpAvMVFAamTf/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.veza.com/4yItIzMvkpAvMVFAamTf/features/access-reviews/configuration/access-reviews-query-builder.md). # Access Reviews Query Builder Reference for the review configurations query builder. ### Overview Reviews you create can be organization-wide, or constrained to specific applications or populations of users. Use the query builder to scope reviews to meet the needs of your organization based on what data sources you have integrated, the specific compliance requirements of your organization, and existing review processes. For instance, a review configuration might specify: * All users with specific permissions on all databases of a certain type. * Users with any access to an individual application. * Access for a subset of users, based on an attribute, such as "department." The results of the query are used to compile the list of items included in an individual access or entitlements review. Depending on the objective of the review, these items can be further enriched with: * System and Effective Permissions for a relationship, such as the permissions that a user has when accessing a particular resource * A summary of the path that made the access connection - useful to show that an intermediary group or role is granting a user access * Additional metadata about the source or destination entities to provide more context to reviewers. Queries are especially powerful when entities in your access graph have attributes or tags defining ownership, applicability to compliance rules or regulations, regional metadata, and other organizational attributes. Additional metadata can include Veza tags, native tags originating from the data source (i.e. AWS tags), and Open Authorization API custom properties, as well as details about a related identity from your Identity provider or HRIS system. This document provides an overview of all configuration options and guidance on using entity type groupings to review access for many entity types using a single configuration. This document provides an overview of all configuration options and guidance on using entity type groupings to review access for many entity types using a single configuration. ### Scope Options When defining the scope of a review configuration, you can choose between two approaches: * **Quick Builder**: A simplified option for common use cases. Choose an application, select a review type (e.g., "Okta user AWS IAM group memberships"), and optionally narrow the scope with data source filters. Best for standard access review scenarios without complex filters. * **Advanced Query Builder**: Full control over source/destination entity types, filters, permissions, intermediate entities, and relationship options. Use this for custom or complex review scopes. The remainder of this document describes the Advanced Query Builder options. For 1-step access reviews (Early Access), see [1-Step Access Reviews](/4yItIzMvkpAvMVFAamTf/features/access-reviews/configuration/1-step-review.md). ### Reference: Configuration Query Builder The following table describes the options when defining an access review's scope with the configuration query builder. Note that these options can differ from those available in the Access Visibility query builder, and include parameters specifically designed for access reviews. The entity types available as query source or destination depend on your configured integrations. | Field | Description | | ---------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Name** | A friendly name for the configuration, used for notification messages and shown on the *Access Reviews* page. | | **Description** | Describes the configuration's scope and purpose. The description propagates by default to every review created from this configuration and appears in the Reviewer Interface above the results table; it can be overridden per review in the *Review Details* step of the configuration wizard. Also exported in the *Review Description* column of CSV, XLSX, and consolidated reports. | | **Query Mode: Effective** | When enabled, returns effective permission calculations for the source and destination pair. | | **Query Mode: System** | When enabled, returns system-level entities and raw permissions for the source and destination pair. | | **Source Entity Type** | Selects the entities to review (typically an *identity*). The results will include all entities of the chosen type. | | **Destination Entity Type** | Usually, one or more types of resources to approve an identity's permissions on. However, any entity can be the final node of the path (such as a role, service, or group). Rows will show source entities and their relationships to entities of the chosen type. | | **Select a single entity (Optional)** | When selected, only show access involving a specific source or destination entity, specified by name. | | **Preview source/destination entities** | Update the results table to preview source or destination entities based on Veza's most recent graph data. Reviewers will certify the query results based on graph data at the time of review creation. | | **Advanced Options: Include source tags in review results** | When enabled, reviews include a column showing the keys of any tags on the source entity. | | **Advanced Options: Include destination tags in review results** | When enabled, reviews include a column showing tag keys for the destination entity. | | **Advanced Options: Relationship** | Enables optional columns for reviewers, showing the full entity metadata when an entity of the selected type exists in the path between the source and destination (such as the group granting an Okta user access to an app). | | **Advanced Options: Summary Entities** | The review will include a column indicating the names and hierarchical relationships of the specified entity types. | | **Advanced Options: Exclude Entities** | Exclude results with a relationship to the selected intermediate entity type(s), for example, to review users not assigned to groups. | | **Advanced Options: Require Entities** | Only show results that have a relationship to the required entity type(s), such as users directly assigned to groups. | | **Relationship Options: Include Assumed** | By default, reviews contain a row for each unique source-destination relationship, including assignments that are due to nested groups, roles, or projects. Disable this option to only include rows for the top-level assignment. | | **Advanced Options: Relationship** | An intermediate entity category to require, such as a local user account, group, or role. When specified, details on this intermediate node appear in an additional review column. | | **Enrich with IdP/HRIS Metadata** | Choose related entity types to include their attributes in the reviewer interface. See [Identity Provider and HRIS Enrichment](/4yItIzMvkpAvMVFAamTf/features/access-reviews/configuration/enrich-idp-hris.md) to learn more. | | **Filters: Attributes** | Filter by an entity property, such as user `department`. Click *+ Add Predefined Attribute Filter* to quickly add a filter on the user "manager" attribute, when the source user is the same as the user entity type defined in Access Reviews Global IdP Settings. | | **Filters: Tags** | Only return results that include (or don’t include) the specified tags. Tags can be Veza Tags, or discovered tags native to an integration, such as AWS Tags or Snowflake Tags. Enabling *Show Source/Destination Tags* will additionally provide reviewers with the ability to see any tags applied to the results, and sort and filter by tags within the review interface. | | **Filters: Permissions** | Only return results with specific privileges on the destination resource. Permissions can be *effective* or *system*. Based on the operator, matches can be "all" or "any". Applying a permissions filter to a query that does not involve permissions (such as User to Role) will return no results. | ### Entity Type Groupings Use entity type groupings in a configuration to include several entity types in the scope of an access review. Choosing an entity type grouping as the source or destination will include all entities within that grouping. Use these to construct queries such as "All Principals to all Custom Application Role," or "All Top Level Principals to GitHub Repositories." #### Generic entity type groupings * **All Principals**: Entities with the `Identity` label, including machine entity types that can have permissions on resources. * **All Top Level Principals**: `Identity`-type entities that cannot be assumed by another identity. Use this option to show primary organizational identities (e.g., IdP users), and filter out any low-level identities (such as local users) they can assume. Reviews will contain local users and service accounts that don’t have an upper-level identity. * **All Local Users**: Entities with the `LocalUser` label (e.g., Google Cloud SQL User, Hashicorp Vault Alias, or MongoDB Users) * **All Resources**: All entities with the `Resource` label. * **AccessCreds**: Entities with the `AccessCreds` label. {% hint style="success" %} You can check which entities are included in an entity type grouping using the query builder. Search for the label in **Access Visibility** > **Query Builder** and review the list of included entities in the **Filter By Type** dropdown menu. {% endhint %} #### Entity type groupings for custom applications Some special entity type groupings are provided specifically for Access Reviews. These return all "custom" users, roles, resources, and other entities added to Veza using Open Authorization API templates. These groupings enable scoping reviews to for all users or resources in custom applications, identity providers, and HRIS platforms: * Custom Applications * Custom Subresources * Custom Resources * Custom Users * Custom Roles * Custom Role Assignments * Custom IdP Domains * Custom IdP Groups * Custom IdP Users * Custom Groups * Custom Permissions Custom entities and their attributes are defined in the JSON push payload created by OAA connectors. For more information about these entity types and attributes, see [OAA Templates](/4yItIzMvkpAvMVFAamTf/developers/api/oaa/templates.md). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.veza.com/4yItIzMvkpAvMVFAamTf/features/access-reviews/configuration/access-reviews-query-builder.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.