An Access Request workflow with multi-step approval allows for the required dual-approval process (data owner + security officer). Incorporating a time-bound entitlement within that request is the specific feature that ensures automatic revocation after the set duration (48 hours). This creates a unified process that satisfies all the stated control objectives.

The core issue is a lack of a governed access model. Implementing RBAC establishes a standard (‘what access should be’), and using certification campaigns provides the recurring governance mechanism to review both adherence to the standard (role membership) and the business justification for any deviations (exceptions). This is a proactive, policy-based solution rather than a reactive, manual one.

Saviynt’s lifecycle policies can process future-dated events. By populating the ‘Effective Date’ field with the user’s termination date, the policy engine will schedule the revocation actions (disable, delete, remove entitlements) to execute on that specific date, allowing for a precise and automated offboarding aligned with the employment end date.

The issue is a flaw in the governance process (approval), not necessarily in the static entitlements a user holds. The approval workflow rules define who is eligible to approve a request. To prevent self-approval, these rules must be configured to exclude the requester from the approver list, typically by using rule logic based on manager, role, or attribute.

This is a common connector limitation workaround. By leveraging the supported functionality (group push), you can create a Saviynt group whose membership is dynamically calculated based on department (e.g., ‘Sales-Department’). The SCIM connector can then provision users to the identically named group in the SaaS app, effectively synchronizing the department data via group membership.

The ‘Approval Step’ feature within certification campaigns allows you to mandate an additional approval for certain decisions (like Revoke or Modify) before Saviynt’s policy engine executes them. This creates a formal, auditable, two-step governance process for high-risk actions, unlike a simple email which is not enforceable or tracked within the platform.

Bundles are a key feature designed specifically for this problem. They allow administrators to map multiple low-level technical entitlements (e.g., ‘ACCT_PAY_APP_UPDATE’, ‘ACCT_PAY_APP_VIEW’) to a single, business-meaningful term (e.g., ‘Accounts Payable Clerk’). This dramatically simplifies the reviewer’s task, presenting them with a manageable list of business functions to attest to.

The Identity Warehouse consolidates user data, including attributes like ‘last login date’ sourced from the application. The Analytics engine or custom reporting rules allow you to query this data warehouse. You would create a rule or report that filters users based on the ‘last login date’ attribute being older than 90 days for the specific application in question.

Risk levels are a critical governance tool. A ‘High’ risk SoD conflict might be configured for preventive enforcement (blocking provisioning) and require immediate remediation. A ‘Medium’ risk conflict might only generate a detective violation report for review during certifications. The risk level helps organizations focus their compliance efforts on the most critical business risks.

An Access Request workflow with multi-step approval allows for the required dual-approval process (data owner + security officer). Incorporating a time-bound entitlement within that request is the specific feature that ensures automatic revocation after the set duration (48 hours). This creates a unified process that satisfies all the stated control objectives.0