--- title: "Understanding the Base Entitlement" slug: "base-entitlements" description: "Every Clarity application has a Base Entitlement that shows who has an active account. Learn how it's granted, removed, used for provisioning, and reviewed." tags: ["About", "Access Reviews", "entitlement"] updated: 2026-11-12T00:18:21Z published: 2026-11-12T00:18:21Z canonical: "help.claritysecurity.com/base-entitlements" --- > ## Documentation Index > Fetch the complete documentation index at: https://help.claritysecurity.com/llms.txt > Use this file to discover all available pages before exploring further. # Understanding the Base Entitlement ## Overview Every application in Clarity has one built-in entitlement named **Base Entitlement** (for example, *Slack Base Entitlement*). Clarity creates it automatically. You don't need to set it up, and you can't delete it. The Base Entitlement doesn't stand for a group, role, or permission in the application. It means one thing: **this identity has an active account in this application.** This gives Clarity a consistent way to show who has an account in each application, even when the application has no groups or roles, or the account has none assigned. ## How the Base Entitlement Is Granted Clarity grants the Base Entitlement automatically. There are two ways it happens: | When | What happens | | --- | --- | | **Application sync** | For every **active** account Clarity finds in the application, the account's identity gets the Base Entitlement. | | **Account creation through Clarity** | When Clarity creates an account in an application (for example, from a workflow, an access request, or an ABAC profile), the identity gets the Base Entitlement. | > [!NOTE] > Note > > Accounts that Clarity hasn't matched to an identity yet (shown under **Alerts > Identity Resolution**) also carry the Base Entitlement. Once the account is matched, the Base Entitlement moves to the identity along with the account. ## How the Base Entitlement Is Removed The Base Entitlement follows the account. When the account is disabled or deleted in the application, the next application sync removes the Base Entitlement from the identity. You can't remove the Base Entitlement by hand. On an identity's **Entitlements** tab, Base Entitlements don't have a **Remove** button. To take away someone's access to an application, remove the account itself. See **Removing someone's access to an application** below. ## Using the Base Entitlement to Provision Accounts Some applications, like Slack, have nothing to grant beyond the account itself. For these applications, use the Base Entitlement anywhere you would normally pick an entitlement to grant, such as an ABAC profile or a provisioning step in a workflow. When Clarity provisions the Base Entitlement, it: 1. Checks whether the identity already has an account in the application. 2. Creates the account if it doesn't exist (on applications where Clarity can create accounts). 3. Grants the Base Entitlement to the identity. If Clarity can't create the account, the provisioning step fails with the reason *"Unable to create service user or service requires accepted invite to activate account."* ## Base Entitlements in Access Reviews Base Entitlements can appear as items in user access reviews, alongside an account's other entitlements. Approving one confirms the person should keep their account in that application. **Important:** Denying a Base Entitlement in an access review does **not** disable the account in the application. The item may show as remediated, but the account stays active, and the next sync reports it as active again. ### Removing someone's access to an application To actually remove an account, terminate the account instead of denying the Base Entitlement: - **From an access review:** use the option to terminate the service user (account) on the review item. - **From the Identity page:** use **Deactivate Service User** for that application's account. Once the account is disabled or deleted in the application, the next sync removes the Base Entitlement automatically. ## Where Base Entitlements Are Left Out Base Entitlements aren't real permissions, so Clarity leaves them out of places where they would only add noise: - **Entitlement counts** on the Applications page and application details. - **Workflow email lists** of entitlements that need manual action, such as the lists of entitlements Clarity can't provision or remove on read-only applications. ## Frequently Asked Questions **Why does every person on an application have the same "Base Entitlement"?** Because it represents the account, not a permission. Everyone with an active account in the application has it. **I renamed an application. Do I need to update the Base Entitlement?** No. When you rename an application, Clarity renames its Base Entitlement to match. **Can I delete the Base Entitlement?** No. Each application always has exactly one Base Entitlement, and Clarity manages it for you. **What is the "Clarity Base Entitlement"?** It is the Base Entitlement for the Clarity application itself. It represents a person's account in Clarity and is part of what allows them to sign in. ## Need Help? If you have any problems, contact your customer success team. You can also get in touch with our general support [via email](mailto:support@claritysecurity.io), open a [support ticket](https://support.claritysecurity.com/home). Our general support team is available Monday - Friday from 8:00 AM - 6:30 PM CST. ## Related - [Clarity Entitlements](/clarity-entitlements.md) - [What are Entitlements?](/what-are-entitlements.md)