> For the complete documentation index, see [llms.txt](https://docs.balkan.id/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.balkan.id/~/revisions/mC3o0sGSsz3AIawh8Hk1/lifecycle-management/policies.md). # Policies ## Policies Configuration Guide ### Overview Policies in BalkanID enable administrators to automate access decisions by defining conditions and actions that are evaluated consistently across access requests, purpose-based access. Using policies, admins can automatically approve, deny, or route access to specific reviewers, reducing manual effort while maintaining strong governance and auditability. This guide walks through the end-to-end process of creating and managing policies, explains supported actions, and illustrates how policies are evaluated. ### What Are Policies? A policy is a structured set of rules evaluated in a top-down order. Each rule defines *when* the policy applies, and each clause defines *what action* should be taken when a rule matches. Policies are commonly used to: * Auto-approve low-risk access * Auto-deny restricted or non-compliant access * Assign access requests to specific reviewers based on conditions ### Accessing the Policies Page 1. Log in to BalkanID `.app.balkan.id` 2. Navigate to Configure → Global Settings → Policies On the Policies page, administrators can: * View all existing policies * See policy type and status (Active / Inactive) * Create new policies * Edit or de-activate existing policies

### Creating a New Policy #### Step 1: Start Policy Creation 1. Click Create Policy on the Policies page 2. Select the Policy Type (Purpose / Request) 3. Enter basic details: * Policy name * Description * Status (Active or Inactive) * Priority (only for 'Request' type Policies)

### Defining Policy Clauses Policies are evaluated **top-down**, meaning the first matching clause determines the action. Each clause consists of: * One or more **conditions (rules)** * An **action** to take when conditions match The UI presents clauses in a clear, ordered format inspired by modern feature-flag tools, making complex logic easy to understand and manage.

### Creating or Selecting Rules Within the policy editor, admins can: * Create a new rule inline, or * Select an existing rule from saved rules Rules are defined using a visual filter builder based on attributes such as: * User attributes (job title, department, employment type) * Application or entitlement attributes * Access purpose or campaign context All required fields are validated before saving.

### Supported Policy Actions Policies support the following actions: #### Auto-Approve When conditions match, the access request or review item is automatically approved by the system. * No reviewer involvement required * Recorded as a system action * Visible in audit logs and activity history

#### Auto-Deny When conditions match, the access request or review item is automatically denied. * Prevents unnecessary review cycles * Recorded as a system action * Fully auditable\ ![](https://2975852473-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbVGYwk8aSk5yI1GDPEW9%2Fuploads%2FHTXNFB3UCOiS9Y1JZlHL%2Fimage.png?alt=media\&token=a76b08f3-79ef-4eee-8dc1-b606058e743b)
#### Auto-Assign to Reviewer When conditions match, the item is automatically assigned **to a specific reviewer/s** * Enables deterministic reviewer routing * Reduces ambiguity in ownership * Ensures consistent escalation paths\ ![](https://2975852473-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbVGYwk8aSk5yI1GDPEW9%2Fuploads%2FajZlHxdRj0NOm9cWQHdw%2Fimage.png?alt=media\&token=314e7823-fe49-4a93-9e4f-56aef3261863)
### Policy Evaluation Behavior When an access request or review item is created: 1. The attached policy is evaluated 2. Clauses are checked **in order** 3. The first matching clause triggers its action 4. If no clause matches: * The item follows the default manual workflow ### Attaching Policies Policies can be attached to: * Access request workflows * Purpose-based access flows ### Audit and Visibility All policy-driven decisions: * Are clearly marked as system-driven * Capture the policy and rule that triggered the action * Appear in audit logs and activity timelines This ensures transparency, compliance, and easy troubleshooting. ### Best Practices * Use auto-approve for low-risk, repeatable access * Use auto-deny for clearly restricted access * Use auto-assignment to enforce ownership ### Summary Policies in BalkanID provide a powerful way to automate access decisions while preserving control and auditability. By combining clear conditions with deterministic actions, administrators can scale access governance efficiently and confidently. For advanced use cases or assistance, please contact BalkanID Support: --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.balkan.id/~/revisions/mC3o0sGSsz3AIawh8Hk1/lifecycle-management/policies.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.