Much like Downstream Applications connected to Clarity, the entitlements listed under the Clarity Application are used to define access to Clarity itself. Clarity has several entitlements, each capable of granting a different type or level of access to the application. Some entitlements are granted automatically when a user is given a Clarity login or logs in with SSO, see the section below for details: Granting Access.
Clarity Entitlements
The tables below describe functionality in Clarity and what Clarity Entitlements have permissions on those features. Please see the section below regarding granting someone access to Clarity.
For each of the features/functions in the tables below, a logged in user may be able to view/modify objects that they own such as application owners, role owners, review items assigned to that identity, etc. The tables below describe permissions that apply globally to Clarity Entitlements. A ✔️* means the permission is limited in scope; the note under the table explains the limit. See the other sections of this article below to learn more.
When Access Hub is enabled, a user whose only Clarity entitlements are Manager and/or End User is sent to the Access Hub and does not see the admin side of Clarity. The admin side is available to Admin, Access Certification Admin, Audit, Identity Manager, ReadAll, and Reporting.
Access Reviews
| Entitlement | View | Create | Update | Delete |
|---|---|---|---|---|
| Admin | ✔️ | ✔️ | ✔️ | ✔️ |
| Access Certification Admin | ✔️ | ✔️ | ✔️ | ✔️ |
| Audit | ✔️ | ❌ | ❌ | ❌ |
| Identity Manager | ❌ | ❌ | ❌ | ❌ |
| Manager | ✔️* | ❌ | ❌ | ❌ |
| ReadAll | ✔️ | ❌ | ❌ | ❌ |
| Reporting | ❌ | ❌ | ❌ | ❌ |
* Manager only sees reviews that have items assigned to them, and can review or reassign those items. Managers do not see the Access Reviews admin list. Audit can also export any review (see File Exports).
Alerts
| Entitlement | View | Create | Update | Delete |
|---|---|---|---|---|
| Admin | ✔️ | ✔️ | ✔️ | ✔️ |
| Access Certification Admin | ❌ | ❌ | ❌ | ❌ |
| Audit | ❌ | ❌ | ❌ | ❌ |
| Identity Manager | ❌ | ❌ | ❌ | ❌ |
| Manager | ❌ | ❌ | ❌ | ❌ |
| ReadAll | ❌ | ❌ | ❌ | ❌ |
| Reporting | ❌ | ❌ | ❌ | ❌ |
The Alerts page is only available to Admin. Any logged in user can see and act on alerts that are addressed to them, and a supervisor can act on alerts addressed to their direct reports.
Applications
| Entitlement | View | Create | Update | Delete |
|---|---|---|---|---|
| Admin | ✔️ | ✔️ | ✔️ | ✔️ |
| Access Certification Admin | ✔️* | ❌ | ❌ | ❌ |
| Audit | ✔️ | ❌ | ❌ | ❌ |
| Identity Manager | ❌ | ❌ | ❌ | ❌ |
| Manager | ❌ | ❌ | ❌ | ❌ |
| ReadAll | ✔️ | ❌ | ❌ | ❌ |
| Reporting | ❌ | ❌ | ❌ | ❌ |
* Access Certification Admin can open the Applications list but not an individual application's details.
Entitlements
| Entitlement | View | Create | Update | Delete |
|---|---|---|---|---|
| Admin | ✔️ | ✔️ | ✔️ | ✔️ |
| Access Certification Admin | ❌ | ❌ | ❌ | ❌ |
| Audit | ✔️ | ❌ | ❌ | ❌ |
| Identity Manager | ❌ | ❌ | ❌ | ❌ |
| Manager | ❌ | ❌ | ❌ | ❌ |
| ReadAll | ✔️ | ❌ | ❌ | ❌ |
| Reporting | ❌ | ❌ | ❌ | ❌ |
File Exports (Access Reviews and Reports)
| Entitlement | View | Create | Download | Delete |
|---|---|---|---|---|
| Admin | ✔️ | ✔️ | ✔️ | ✔️ |
| Access Certification Admin | ✔️ | ✔️ | ✔️ | ✔️ |
| Audit | ✔️ | ✔️* | ✔️ | ❌ |
| Identity Manager | ❌ | ❌ | ❌ | ❌ |
| Manager | ❌ | ✔️* | ❌ | ❌ |
| ReadAll | ✔️ | ❌ | ❌ | ❌ |
| Reporting | ❌ | ✔️* | ❌ | ❌ |
* Audit can export any Access Review. Manager can export the items assigned to them in a review. Reporting can export any report they can view. Every user can see and download the files they generated themselves, regardless of entitlement.
Identities
| Entitlement | View | Create | Update | Delete |
|---|---|---|---|---|
| Admin | ✔️ | ✔️ | ✔️ | ❌* |
| Access Certification Admin | ✔️ | ✔️ | ❌ | ❌ |
| Audit | ✔️ | ❌ | ❌ | ❌ |
| Identity Manager | ✔️ | ✔️ | ✔️* | ❌ |
| Manager | ✔️* | ❌ | ❌ | ❌ |
| ReadAll | ✔️ | ❌ | ❌ | ❌ |
| Reporting | ❌ | ❌ | ❌ | ❌ |
* Deleting an identity is reserved for Clarity Support; an Admin deactivates identities instead. Identity Manager can edit an identity's core attributes (name, email, supervisor, type) and the Active flag, but not their own record or any identity linked to their own. Manager can open the Identities list and view themselves and their direct reports.
Reports
| Entitlement | View | Create | Update | Delete |
|---|---|---|---|---|
| Admin | ✔️ | ✔️ | ✔️ | ✔️ |
| Access Certification Admin | ❌ | ❌ | ❌ | ❌ |
| Audit | ✔️ | ❌ | ❌ | ❌ |
| Identity Manager | ❌ | ❌ | ❌ | ❌ |
| Manager | ❌ | ❌ | ❌ | ❌ |
| ReadAll | ✔️* | ❌ | ❌ | ❌ |
| Reporting | ✔️ | ✔️ | ❌ | ❌ |
* ReadAll can open the Reports list but not an individual report. Access to a specific report can also be granted directly to an Identity or to an Entitlement from the report's settings.
Roles
| Entitlement | View | Create | Update | Delete |
|---|---|---|---|---|
| Admin | ✔️ | ✔️ | ✔️ | ✔️ |
| Access Certification Admin | ❌ | ❌ | ❌ | ❌ |
| Audit | ✔️ | ❌ | ❌ | ❌ |
| Identity Manager | ❌ | ❌ | ❌ | ❌ |
| Manager | ❌ | ❌ | ❌ | ❌ |
| ReadAll | ✔️ | ❌ | ❌ | ❌ |
| Reporting | ❌ | ❌ | ❌ | ❌ |
See Role Owner below: supervisors and Role Owners can create roles and manage access on the roles they are responsible for.
Settings (Clarity)
| Entitlement | View | Create | Update | Delete |
|---|---|---|---|---|
| Admin | ✔️ | ✔️ | ✔️ | ✔️ |
| Access Certification Admin | ❌ | ❌ | ❌ | ❌ |
| Audit | ✔️ | ❌ | ❌ | ❌ |
| Identity Manager | ❌ | ❌ | ❌ | ❌ |
| Manager | ❌ | ❌ | ❌ | ❌ |
| ReadAll | ✔️ | ❌ | ❌ | ❌ |
| Reporting | ❌ | ❌ | ❌ | ❌ |
Tags
| Entitlement | View | Create | Update | Delete |
|---|---|---|---|---|
| Admin | ✔️ | ✔️ | ✔️ | ✔️ |
| Access Certification Admin | ❌ | ❌ | ❌ | ❌ |
| Audit | ✔️ | ❌ | ❌ | ❌ |
| Identity Manager | ❌ | ❌ | ❌ | ❌ |
| Manager | ❌ | ❌ | ❌ | ❌ |
| ReadAll | ✔️ | ❌ | ❌ | ❌ |
| Reporting | ❌ | ❌ | ❌ | ❌ |
Workflows (Legacy)
| Entitlement | View | Create | Update | Delete |
|---|---|---|---|---|
| Admin | ✔️ | ✔️ | ✔️ | ✔️ |
| Access Certification Admin | ❌ | ❌ | ❌ | ❌ |
| Audit | ✔️* | ❌ | ❌ | ❌ |
| Identity Manager | ❌ | ❌ | ❌ | ❌ |
| Manager | ❌ | ❌ | ❌ | ❌ |
| ReadAll | ✔️* | ❌ | ❌ | ❌ |
| Reporting | ❌ | ❌ | ❌ | ❌ |
* Audit and ReadAll can open the legacy Workflows list but not an individual workflow.
Lifecycle Management (Dynamic Workflows, Forms, ABAC)
| Entitlement | View | Create | Update | Delete |
|---|---|---|---|---|
| Admin | ✔️ | ✔️ | ✔️ | ✔️ |
| Access Certification Admin | ❌ | ❌ | ❌ | ❌ |
| Audit | ❌ | ❌ | ❌ | ❌ |
| Identity Manager | ✔️* | ❌ | ❌ | ❌ |
| Manager | ❌ | ❌ | ❌ | ❌ |
| ReadAll | ✔️* | ❌ | ❌ | ❌ |
| Reporting | ❌ | ❌ | ❌ | ❌ |
* The Lifecycle Management dashboard and the workflow builder are Admin only. Identity Manager can open the Onboarding, Mover, and Leaver forms and view every form submission. ReadAll can view ABAC attributes and profiles.
Application, Role, and Entitlement Owners
Application Owner
The following are additional permissions granted to any Identities assigned as an Application Owner, limited to the specific application(s):
- View the Applications list
- View details about their application
- Update configurations for their application
- Delete their application
- Perform a manual sync of their application and view its sync logs
- Upload files to their application (file-based applications)
- Delete attribute mappings for their application
- Create entitlements and entitlement groups
- View entitlement details for their application's entitlements
- Manage Push Attribute rules for their application
Application Owners do not have access to the Entitlements admin list; they reach their entitlements through the application.
Role Owner
The following are additional permissions granted to any Identities assigned as a Role Owner, limited to the specific role(s):
- Create new roles
- Manage Role Access for their role
A supervisor (any Identity with direct reports) has the same two permissions for their own role and the roles of their direct reports, without being assigned as a Role Owner.
Entitlement Owner
The following are additional permissions granted to any Identities assigned as a Entitlement Owner, limited to the specific entitlement(s):
- Update entitlements they own
- View details about entitlements they own
- Request removal of their entitlement from an Identity
Entitlement Owners do not have access to the Entitlements admin list; they reach their entitlements from the Identity or Application pages.
Manager, Base User, End User, and Identity Manager
End Users and Managers have access to features in Clarity not outlined above, such as Self Service Access Requests, Approvals, and some Alert activities. They do not have any Global access on those items, which is why those entitlements aren't listed in the tables above.
Manager
Managers, similar to Access Certification Admins or Admins, can be set as the Default Reviewer. This is the standard entitlement to provide to someone who needs to perform the Review portion of an Access Review. Managers can also submit Mover and Leaver forms for their direct reports when Lifecycle Management forms are in use.
Base User
Base User is automatically granted and simply enables the ability for the Identity to log into the platform. An Identity without Base User cannot log in at all, even with SSO. See below about the Grant Clarity Login button.
End User
End User is automatically granted as described below, and provides the lowest level of access within Clarity. This entitlement primarily grants access to the Self Service Portal / Access Hub.
Identity Manager
Identity Manager is a delegated role for people who onboard and offboard Identities without being full Admins. It is granted manually by an Admin. An Identity Manager can view every Identity, add a new Identity through the onboarding form, edit an Identity's core attributes, deactivate or reactivate an Identity, and view all form submissions. They cannot edit their own record or any Identity linked to their own, and they have no access to Settings, Reports, Access Reviews, Workflows, or ABAC.
Granting Access
Grant Clarity Login
When you click the Grant Clarity Login button depicted below (this is found on the Identity page for the individual user), this enables the account to Login by granting them the Base User and End User entitlements. If the Identity is assigned any Access Review items, the Manager entitlement is granted at the same time.
An email will be sent to the email address for the Identity prompting them to reset the password for your account.
The article below walks you through that process.
How to Reset your Password
Login with SSO
If you have SSO correctly configured for Clarity:
- User attempts to log in to Clarity, which redirects to the SSO provider of your choice. The user enters their credentials into this service.
- SSO Provider either approves or denies the login attempt (based on group membership in SSO Provider), and tells Clarity whether the login was successful. If successful, then the process continues to steps 3 and 4.
- On the first login, Clarity creates the login account and links it to the Identity.
- On every login, as long as the Identity is active, Clarity makes sure the Base User and End User entitlements are present, and grants the Manager entitlement if the Identity is assigned any Access Review items (past or present).
Because step 4 runs on every SSO login, removing the Manager entitlement from an Identity that still has Access Review items assigned to them will not stick; it is granted again the next time they log in. Reassign their review items first if the Manager entitlement needs to be removed.
Need help?
If you have any problems, contact your customer success team. You can also get in touch with our general support via email, open a support ticket. Our general support team is available Monday - Friday from 8:00 AM - 6:30 PM CST.