On-Demand Reviews
Enable Access Intelligence alert rules to create access reviews when query results change.
Early Access: On-Demand Reviews are currently provided as an Early Access feature. Please contact the Customer Success team to enable this functionality on your Veza platform.
Overview
Veza Access Reviews support on-demand reviews using Access Intelligence alert rules. By attaching review creation rules to saved queries, you can trigger the creation of new reviews in response to changes in your authorization environment. This type of access review might be initiated whenever new user accounts are detected within an application, new entitlements are granted, a user's risk level increases, or if MFA is removed or disabled for an account.
On-demand reviews support Review Intelligence rules, and are created with a duration and reviewer assignments based on the rule configuration.
Common scenarios for implementing on-demand reviews include:
Automatically reviewing access for terminated employees
Certifying access when users are added to new roles
Validating permissions after attribute changes
Reviewing orphaned or inactive accounts
Important concepts:
Rules are conditions attached to saved queries that trigger automated actions when met.
Review Creation Plans are rule settings that define how new reviews will be created.
Rule Triggers are attribute-based or change-based criteria that initiate review creation (for example, when the query results have increased, or when an entity's
is_activeattribute changes).Creation Source: On the Access Reviews page, you can identify the source of a review by checking the Creation Source column. On-demand rules will have the source
RULE_TRIGGERED.
Implementing On-Demand Reviews
Prerequisites
Before configuring on-demand reviews, you will need to:
Create at least one access review configuration defining the scope of reviews.
Build and save a query that identifies the entities requiring review, or use a built-in query.
Add a Rule for On-Demand Reviews
To add a review creation rule:
Navigate to the saved query
Select "Manage Rules" from the actions menu
Click "Add New Rule"
Configure the rule details:
Name and description
Severity level
Trigger conditions
Click Action -> Create Review to open the review creation plan.
Configure the plan and save it.
Save the rule, and click Save again to finish modifying the query.
See Saved Queries for more on working with existing queries.
To configure the review creation plan
Click Configure New On-Demand Review
Select an existing review configuration
Set the duration for the review
Specify the reviewer assignment logic
Enable any Review Intelligence Rules
Save the plan.
New reviews will start based on this creation plan when the rule conditions are met. Note that on-demand reviews are always created from the most recent graph snapshot data when the rule activates.
See Create Access Review for details on configuring new reviews.
Rule Evaluation
Rules are evaluated on a regular schedule aligned with data extraction intervals
Multiple rules can be attached to a single query
Each rule can include more than one review creation plan
The same review configuration can be used across multiple rules
Related Topics
Last updated