> For the complete documentation index, see [llms.txt](https://docs.veza.com/4yItIzMvkpAvMVFAamTf/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.veza.com/4yItIzMvkpAvMVFAamTf/features/access-reviews/configuration/on-demand-reviews.md). # On-Demand Reviews Enable Access Intelligence alert rules to create access reviews when query results change. > Early Access: On-Demand Reviews are currently provided as an Early Access feature. Please contact the Customer Success team to enable this functionality on your Veza platform. ### Overview Veza Access Reviews support on-demand reviews using Access Intelligence alert rules and Lifecycle Management triggers. By attaching review creation rules to saved queries, you can trigger the creation of new reviews in response to changes in your authorization environment. This type of access review might be initiated whenever new user accounts are detected within an application, new entitlements are granted, a user's risk level increases, or if MFA is removed or disabled for an account. On-demand reviews support Review Intelligence rules, and are created with a duration and reviewer assignments based on the rule configuration. These reviews automatically focus only on changed items, filtering out entities that haven't been modified since the last review. Common scenarios for implementing on-demand reviews include: * Automatically reviewing access for terminated employees * Certifying access when users are added to new roles * Validating permissions after attribute changes * Reviewing orphaned or inactive accounts Important concepts: * **Rules** are conditions attached to saved queries that trigger automated actions when met. * **Create Reviews** settings define how new reviews will be created when rule conditions are met. * **Rule Triggers** are attribute-based or change-based criteria that initiate review creation (for example, when the query results have increased, or when an entity's `is_active` attribute changes). * **Launch Configuration** determines how reviews are created when rules trigger: as a single consolidated review or as separate individual reviews. * **Creation Source**: On the *Access Reviews* page, you can identify the source of a review by checking the Creation Source column. On-demand reviews will have the source `RULE_TRIGGERED` for Access Intelligence alerts or `LCM_TRIGGERED` for Lifecycle Management actions. ### Implementing On-Demand Reviews #### Prerequisites Before configuring on-demand reviews, you will need to: 1. Create at least one access review configuration defining the scope of reviews. 2. Build and save a query that identifies the entities requiring review, or use a built-in query. #### Add a Rule for On-Demand Reviews To add a review creation rule: 1. Navigate to the saved query 2. Select "Manage Rules" from the actions menu 3. Click "Add New Rule" 4. Configure the rule details: * Name and description * Severity level * Trigger conditions 5. Click Action -> Create Review to open the review creation plan. 6. Configure the plan and save it. 7. Save the rule, and click **Save** again to finish modifying the query. See [Saved Queries](/4yItIzMvkpAvMVFAamTf/features/search/saved-queries.md) for more on working with existing queries. To configure the Create Reviews settings: 1. Click **Configure New On-Demand Review** 2. Select an existing review configuration that is compatible with the entity types returned by your rule query. For example: * If your query returns Okta users, select a configuration designed for user reviews * If your query returns AWS roles, select a configuration designed for role reviews * For mixed entity types, select a configuration whose query includes every type. A type with no matching node type stops the review from being created 3. **Configure Launch Options** - Choose how reviews are created when the rule triggers: * **Launch a single Access Review for the entire result set** (Consolidated Mode: `CONSOLIDATED`) - Creates one review containing all triggered results * **Launch a separate Access Review per result entity** (Individual Mode: `INDIVIDUAL`) - Creates separate reviews for each result entity, for up to 150 entities. Above that, Veza creates one consolidated review 4. Set the duration for the review 5. Specify the reviewer assignment logic 6. Enable any Review Intelligence Rules 7. Save the plan. New reviews will start based on this creation plan when the rule conditions are met. Note that on-demand reviews are always created from the most recent graph snapshot data when the rule activates. See [Create Access Review](/4yItIzMvkpAvMVFAamTf/features/access-reviews/how-to/create-access-review.md) for details on configuring new reviews. #### Launch Configuration Options On-demand reviews are created in one of two modes depending on review requirements and the scope of results. **Consolidated Mode** (`CONSOLIDATED`) creates a single access review containing all entities that triggered the rule. The review is scoped to the triggered entities. Above 1,000 triggered entities, Veza runs the full query instead. This typically works best for large datasets, broad policy enforcement, and simplified review management. **Individual Mode** (`INDIVIDUAL`) creates separate access reviews for each entity that triggered the rule. Each review is filtered to show only the specific entity that triggered the rule. This mode enables entity-specific reviews, allowing more granular oversight with unique reviews for each result that can be distributed across reviewers. **Limits and mismatches** Veza applies these rules when it creates on-demand reviews: * **Performance Thresholds**: When more than 1,000 results are triggered, Veza falls back to creating a review using the standard query configuration without entity-specific information. This fallback applies to both Consolidated and Individual modes to ensure optimal performance. * **Individual Mode Limitations**: Individual mode creates separate reviews for up to 150 triggered entities. When this limit is exceeded, Veza creates a single consolidated review containing all triggered entities instead. * **Entity type mismatches**: When a triggered entity's type matches no node type in the review configuration's query, Veza doesn't create the review. See [Troubleshooting](#troubleshooting). ### Troubleshooting Use these checks when an on-demand review isn't created as expected: **Configuration Compatibility Issues**: When a triggered entity's type matches no node type in the review configuration's query, Veza doesn't create the review. It doesn't fall back to a review of the query's full result set. Make sure the configuration's query includes the node types that the rule's query returns, or node types linked to them in the graph. **Mixed Entity Types**: If the query associated with the rule returns different types of entities (users, roles, resources), make sure the review configuration's query includes each type, or a node type linked to it. An entity type with no matching node type stops the review from being created. **Review Creation Failures**: If Veza can't create a review, it continues with the rule's other review configurations. In Individual mode, Veza stops creating reviews for that configuration at the first failure, and reviews already created remain. ### Rule Evaluation * Rules are evaluated on a regular schedule aligned with data extraction intervals (typically during each data refresh cycle) * Multiple rules can be attached to a single query * Each rule can include more than one review creation plan * The same review configuration can be used across multiple rules ### Related Topics * [Creating Access Review Configurations](/4yItIzMvkpAvMVFAamTf/features/access-reviews/how-to/review-configuration.md) * [Building and Saving Queries](/4yItIzMvkpAvMVFAamTf/features/search/query-builder.md) * [Managing Rules and Alerts](/4yItIzMvkpAvMVFAamTf/features/insights/rules-and-alerts.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.veza.com/4yItIzMvkpAvMVFAamTf/features/access-reviews/configuration/on-demand-reviews.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.