Understanding the Base Entitlement

Overview

Every application in Clarity has one built-in entitlement named Base Entitlement (for example, Slack Base Entitlement). Clarity creates it automatically. You don't need to set it up, and you can't delete it.

The Base Entitlement doesn't stand for a group, role, or permission in the application. It means one thing: this identity has an active account in this application.

This gives Clarity a consistent way to show who has an account in each application, even when the application has no groups or roles, or the account has none assigned.

How the Base Entitlement Is Granted

Clarity grants the Base Entitlement automatically. There are two ways it happens:

Note

Accounts that Clarity hasn't matched to an identity yet (shown under Alerts > Identity Resolution) also carry the Base Entitlement. Once the account is matched, the Base Entitlement moves to the identity along with the account.

How the Base Entitlement Is Removed

The Base Entitlement follows the account. When the account is disabled or deleted in the application, the next application sync removes the Base Entitlement from the identity.

You can't remove the Base Entitlement by hand. On an identity's Entitlements tab, Base Entitlements don't have a Remove button. To take away someone's access to an application, remove the account itself. See Removing someone's access to an application below.

Using the Base Entitlement to Provision Accounts

Some applications, like Slack, have nothing to grant beyond the account itself. For these applications, use the Base Entitlement anywhere you would normally pick an entitlement to grant, such as an ABAC profile or a provisioning step in a workflow.

When Clarity provisions the Base Entitlement, it:

1. Checks whether the identity already has an account in the application.

2. Creates the account if it doesn't exist (on applications where Clarity can create accounts).

3. Grants the Base Entitlement to the identity.

If Clarity can't create the account, the provisioning step fails with the reason "Unable to create service user or service requires accepted invite to activate account."

Base Entitlements in Access Reviews

Base Entitlements can appear as items in user access reviews, alongside an account's other entitlements. Approving one confirms the person should keep their account in that application.

Important: Denying a Base Entitlement in an access review does not disable the account in the application. The item may show as remediated, but the account stays active, and the next sync reports it as active again.

Removing someone's access to an application

To actually remove an account, terminate the account instead of denying the Base Entitlement:

• From an access review: use the option to terminate the service user (account) on the review item.

• From the Identity page: use Deactivate Service User for that application's account.

Once the account is disabled or deleted in the application, the next sync removes the Base Entitlement automatically.

Where Base Entitlements Are Left Out

Base Entitlements aren't real permissions, so Clarity leaves them out of places where they would only add noise:

• Entitlement counts on the Applications page and application details.

• Workflow email lists of entitlements that need manual action, such as the lists of entitlements Clarity can't provision or remove on read-only applications.

Frequently Asked Questions

Why does every person on an application have the same "Base Entitlement"? Because it represents the account, not a permission. Everyone with an active account in the application has it.

I renamed an application. Do I need to update the Base Entitlement? No. When you rename an application, Clarity renames its Base Entitlement to match.

Can I delete the Base Entitlement? No. Each application always has exactly one Base Entitlement, and Clarity manages it for you.

What is the "Clarity Base Entitlement"? It is the Base Entitlement for the Clarity application itself. It represents a person's account in Clarity and is part of what allows them to sign in.

Need Help?