> For the complete documentation index, see [llms.txt](https://docs.balkan.id/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.balkan.id/balkanid-mcp/workflows-and-example-prompts.md). # Workflows and Example Prompts ### Overview After you connect your AI client, use this page to run BalkanID workflows in natural language. Each section lists example prompts you can try and the actions available through MCP. Tool names and access requirements are in [Tools Reference](/balkanid-mcp/tools-reference.md). You can also ask your assistant to call **`help`** for an in-session overview. {% hint style="info" %} Available actions depend on your connection scopes (**Read** / **Write**) and your BalkanID role (Reviewer, Risk Manager, or Administrator). See [Authentication and Permissions](/balkanid-mcp/authentication-and-permissions.md). {% endhint %} ### Identity and entitlement discovery Get a live picture of identities, connections, resources, and how they connect across applications. **Example prompts** * “Find terminated employees who still have active access across our apps.” * “Show active service accounts in Azure with no primary owner.” * “List identities in Okta with orphaned status.” * “Find all identities linked to across every integration.” **Supported actions** * List identities with filters (application, type, status, email, handle, and more) * List connections (roles/groups) and resources (repos, channels, projects, and similar) * Explore entity relationships (for example identity → connection, connection → resource) * Pull distinct filter values for investigation (departments, apps, and similar facets) ### Credentials and non-human access Discover credentials such as API keys, tokens, and service account keys from connected systems. **Example prompts** * “Show expired credentials in Azure on production service accounts.” * “Which credentials are unused or look stale?” * “List credentials for a specific application and status.” **Supported actions** * List credentials filtered by type, status, application, integration, or owner * Cross-reference credentials with identities and resources through entity relations ### Integrations See connected applications and refresh data when needed. **Example prompts** * “Show all active integrations and their sync status.” * “Trigger a resync for the Azure integration.” **Supported actions** * List integration instances (defaults to active integrations) * Trigger a sync for an integration (Write scope + Administrator role) ### Employees (HRIS records) Work with employee records used for ownership, requests, and reviews. **Example prompts** * “Who reports to Jane Smith?” * “Onboard a contractor: , Software Engineer, reports to .” **Supported actions** * List employees with filters (department, title, manager, employment type, terminated) * Create or update employees by email (Write scope + Administrator role) ### User access reviews (UAR) Monitor campaigns and action review items. **Example prompts** * “Show overdue access review campaigns and completion rates.” * “How many pending reviews do I have?” * “Approve these review IDs and record the reason for audit.” **Supported actions** * List campaigns (Risk Manager and Administrator) * List campaign or request review items * Approve, reject, or delegate reviews (with optional reason) ### Access requests and JITPBAC Work with access requests and JITPBAC (Just-in-Time Purpose-Based Access Control) through Purposes and Constraints. **Example prompts** * “Show pending access requests assigned to me.” * “Request temporary access to the BLR Manager purpose for , expiring in 7 days.” * “List active Purposes.” * “Show Constraints that deny finance users from production admin roles.” **Supported actions** * List and inspect access requests * Approve, reject, or delegate at request level or by review IDs * List Purposes and Purpose details * Create Purpose requests; assign or unassign yourself when eligible * List, create, update, or delete Constraints (denial policies) — create/update/delete require Risk Manager or Administrator For product background on these workflows, see: * [Access review management](/user-access-reviews/access-review-management.md) * [Access requests](/lifecycle-management/access-requests.md) * [JITPBAC](/lifecycle-management/jitpbac.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.balkan.id/balkanid-mcp/workflows-and-example-prompts.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.