---
title: "Clarity Entitlements"
slug: "clarity-entitlements"
description: "Detailed breakdown of the entitlements which control access to Clarity itself."
tags: ["Clarity", "entitlement"]
updated: 2026-10-13T14:09:34Z
published: 2026-10-13T14:09:34Z
canonical: "help.claritysecurity.com/clarity-entitlements"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.claritysecurity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Clarity Entitlements

Much like Downstream Applications connected to Clarity, the entitlements listed under the Clarity Application are used to define access to Clarity itself. Clarity has several entitlements, each capable of granting a different type or level of access to the application. Some entitlements are granted automatically when a user is given a Clarity login or logs in with SSO, see the section below for details: [Granting Access](/v1/docs/clarity-entitlements#granting-access).

---

## Clarity Entitlements

The tables below describe functionality in Clarity and what Clarity Entitlements have permissions on those features. Please see the section below regarding granting someone access to Clarity.

Note for Application, Role, and Entitlement Owners

For each of the features/functions in the tables below, a logged in user may be able to view/modify objects that they own such as application owners, role owners, review items assigned to that identity, etc. The tables below describe permissions that apply globally to Clarity Entitlements. A ✔️* means the permission is limited in scope; the note under the table explains the limit. See the other sections of this article below to learn more.

Access Hub

When Access Hub is enabled, a user whose only Clarity entitlements are **Manager** and/or **End User** is sent to the Access Hub and does not see the admin side of Clarity. The admin side is available to **Admin**, **Access Certification Admin**, **Audit**, **Identity Manager**, **ReadAll**, and **Reporting**.

### Access Reviews

| Entitlement | View | Create | Update | Delete |
| --- | --- | --- | --- | --- |
| Admin | ✔️ | ✔️ | ✔️ | ✔️ |
| Access Certification Admin | ✔️ | ✔️ | ✔️ | ✔️ |
| Audit | ✔️ | ❌ | ❌ | ❌ |
| Identity Manager | ❌ | ❌ | ❌ | ❌ |
| Manager | ✔️* | ❌ | ❌ | ❌ |
| ReadAll | ✔️ | ❌ | ❌ | ❌ |
| Reporting | ❌ | ❌ | ❌ | ❌ |

* **Manager** only sees reviews that have items assigned to them, and can review or reassign those items. Managers do not see the Access Reviews admin list. **Audit** can also export any review (see File Exports).

### Alerts

| Entitlement | View | Create | Update | Delete |
| --- | --- | --- | --- | --- |
| Admin | ✔️ | ✔️ | ✔️ | ✔️ |
| Access Certification Admin | ❌ | ❌ | ❌ | ❌ |
| Audit | ❌ | ❌ | ❌ | ❌ |
| Identity Manager | ❌ | ❌ | ❌ | ❌ |
| Manager | ❌ | ❌ | ❌ | ❌ |
| ReadAll | ❌ | ❌ | ❌ | ❌ |
| Reporting | ❌ | ❌ | ❌ | ❌ |

The Alerts page is only available to **Admin**. Any logged in user can see and act on alerts that are addressed to them, and a supervisor can act on alerts addressed to their direct reports.

### Applications

| Entitlement | View | Create | Update | Delete |
| --- | --- | --- | --- | --- |
| Admin | ✔️ | ✔️ | ✔️ | ✔️ |
| Access Certification Admin | ✔️* | ❌ | ❌ | ❌ |
| Audit | ✔️ | ❌ | ❌ | ❌ |
| Identity Manager | ❌ | ❌ | ❌ | ❌ |
| Manager | ❌ | ❌ | ❌ | ❌ |
| ReadAll | ✔️ | ❌ | ❌ | ❌ |
| Reporting | ❌ | ❌ | ❌ | ❌ |

* **Access Certification Admin** can open the Applications list but not an individual application's details.

### Entitlements

| Entitlement | View | Create | Update | Delete |
| --- | --- | --- | --- | --- |
| Admin | ✔️ | ✔️ | ✔️ | ✔️ |
| Access Certification Admin | ❌ | ❌ | ❌ | ❌ |
| Audit | ✔️ | ❌ | ❌ | ❌ |
| Identity Manager | ❌ | ❌ | ❌ | ❌ |
| Manager | ❌ | ❌ | ❌ | ❌ |
| ReadAll | ✔️ | ❌ | ❌ | ❌ |
| Reporting | ❌ | ❌ | ❌ | ❌ |

### File Exports (Access Reviews and Reports)

| Entitlement | View | Create | Download | Delete |
| --- | --- | --- | --- | --- |
| Admin | ✔️ | ✔️ | ✔️ | ✔️ |
| Access Certification Admin | ✔️ | ✔️ | ✔️ | ✔️ |
| Audit | ✔️ | ✔️* | ✔️ | ❌ |
| Identity Manager | ❌ | ❌ | ❌ | ❌ |
| Manager | ❌ | ✔️* | ❌ | ❌ |
| ReadAll | ✔️ | ❌ | ❌ | ❌ |
| Reporting | ❌ | ✔️* | ❌ | ❌ |

* **Audit** can export any Access Review. **Manager** can export the items assigned to them in a review. **Reporting** can export any report they can view. Every user can see and download the files they generated themselves, regardless of entitlement.

### Identities

| Entitlement | View | Create | Update | Delete |
| --- | --- | --- | --- | --- |
| Admin | ✔️ | ✔️ | ✔️ | ❌* |
| Access Certification Admin | ✔️ | ✔️ | ❌ | ❌ |
| Audit | ✔️ | ❌ | ❌ | ❌ |
| Identity Manager | ✔️ | ✔️ | ✔️* | ❌ |
| Manager | ✔️* | ❌ | ❌ | ❌ |
| ReadAll | ✔️ | ❌ | ❌ | ❌ |
| Reporting | ❌ | ❌ | ❌ | ❌ |

* Deleting an identity is reserved for Clarity Support; an **Admin** deactivates identities instead. **Identity Manager** can edit an identity's core attributes (name, email, supervisor, type) and the Active flag, but not their own record or any identity linked to their own. **Manager** can open the Identities list and view themselves and their direct reports.

### Reports

| Entitlement | View | Create | Update | Delete |
| --- | --- | --- | --- | --- |
| Admin | ✔️ | ✔️ | ✔️ | ✔️ |
| Access Certification Admin | ❌ | ❌ | ❌ | ❌ |
| Audit | ✔️ | ❌ | ❌ | ❌ |
| Identity Manager | ❌ | ❌ | ❌ | ❌ |
| Manager | ❌ | ❌ | ❌ | ❌ |
| ReadAll | ✔️* | ❌ | ❌ | ❌ |
| Reporting | ✔️ | ✔️ | ❌ | ❌ |

* **ReadAll** can open the Reports list but not an individual report. Access to a specific report can also be granted directly to an Identity or to an Entitlement from the report's settings.

### Roles

| Entitlement | View | Create | Update | Delete |
| --- | --- | --- | --- | --- |
| Admin | ✔️ | ✔️ | ✔️ | ✔️ |
| Access Certification Admin | ❌ | ❌ | ❌ | ❌ |
| Audit | ✔️ | ❌ | ❌ | ❌ |
| Identity Manager | ❌ | ❌ | ❌ | ❌ |
| Manager | ❌ | ❌ | ❌ | ❌ |
| ReadAll | ✔️ | ❌ | ❌ | ❌ |
| Reporting | ❌ | ❌ | ❌ | ❌ |

See [Role Owner](/docs/clarity-entitlements#role-owner) below: supervisors and Role Owners can create roles and manage access on the roles they are responsible for.

### Settings (Clarity)

| Entitlement | View | Create | Update | Delete |
| --- | --- | --- | --- | --- |
| Admin | ✔️ | ✔️ | ✔️ | ✔️ |
| Access Certification Admin | ❌ | ❌ | ❌ | ❌ |
| Audit | ✔️ | ❌ | ❌ | ❌ |
| Identity Manager | ❌ | ❌ | ❌ | ❌ |
| Manager | ❌ | ❌ | ❌ | ❌ |
| ReadAll | ✔️ | ❌ | ❌ | ❌ |
| Reporting | ❌ | ❌ | ❌ | ❌ |

### Tags

| Entitlement | View | Create | Update | Delete |
| --- | --- | --- | --- | --- |
| Admin | ✔️ | ✔️ | ✔️ | ✔️ |
| Access Certification Admin | ❌ | ❌ | ❌ | ❌ |
| Audit | ✔️ | ❌ | ❌ | ❌ |
| Identity Manager | ❌ | ❌ | ❌ | ❌ |
| Manager | ❌ | ❌ | ❌ | ❌ |
| ReadAll | ✔️ | ❌ | ❌ | ❌ |
| Reporting | ❌ | ❌ | ❌ | ❌ |

### Workflows (Legacy)

| Entitlement | View | Create | Update | Delete |
| --- | --- | --- | --- | --- |
| Admin | ✔️ | ✔️ | ✔️ | ✔️ |
| Access Certification Admin | ❌ | ❌ | ❌ | ❌ |
| Audit | ✔️* | ❌ | ❌ | ❌ |
| Identity Manager | ❌ | ❌ | ❌ | ❌ |
| Manager | ❌ | ❌ | ❌ | ❌ |
| ReadAll | ✔️* | ❌ | ❌ | ❌ |
| Reporting | ❌ | ❌ | ❌ | ❌ |

* **Audit** and **ReadAll** can open the legacy Workflows list but not an individual workflow.

### Lifecycle Management (Dynamic Workflows, Forms, ABAC)

| Entitlement | View | Create | Update | Delete |
| --- | --- | --- | --- | --- |
| Admin | ✔️ | ✔️ | ✔️ | ✔️ |
| Access Certification Admin | ❌ | ❌ | ❌ | ❌ |
| Audit | ❌ | ❌ | ❌ | ❌ |
| Identity Manager | ✔️* | ❌ | ❌ | ❌ |
| Manager | ❌ | ❌ | ❌ | ❌ |
| ReadAll | ✔️* | ❌ | ❌ | ❌ |
| Reporting | ❌ | ❌ | ❌ | ❌ |

* The Lifecycle Management dashboard and the workflow builder are **Admin** only. **Identity Manager** can open the Onboarding, Mover, and Leaver forms and view every form submission. **ReadAll** can view ABAC attributes and profiles.

## Application, Role, and Entitlement Owners

### Application Owner

The following are additional permissions granted to any Identities assigned as an Application Owner, limited to the specific application(s):

- View the Applications list
- View details about their application
- Update configurations for their application
- Delete their application
- Perform a manual sync of their application and view its sync logs
- Upload files to their application (file-based applications)
- Delete attribute mappings for their application
- Create entitlements and entitlement groups
- View entitlement details for their application's entitlements
- Manage Push Attribute rules for their application

Application Owners do not have access to the Entitlements admin list; they reach their entitlements through the application.

### Role Owner

The following are additional permissions granted to any Identities assigned as a Role Owner, limited to the specific role(s):

- Create new roles
- Manage Role Access for their role

A supervisor (any Identity with direct reports) has the same two permissions for their own role and the roles of their direct reports, without being assigned as a Role Owner.

### Entitlement Owner

The following are additional permissions granted to any Identities assigned as a Entitlement Owner, limited to the specific entitlement(s):

- Update entitlements they own
- View details about entitlements they own
- Request removal of their entitlement from an Identity

Entitlement Owners do not have access to the Entitlements admin list; they reach their entitlements from the Identity or Application pages.

## Manager, Base User, End User, and Identity Manager

**End Users** and **Managers** have access to features in Clarity not outlined above, such as Self Service Access Requests, Approvals, and some Alert activities. They do not have any Global access on those items, which is why those entitlements aren't listed in the tables above.

### Manager

**Managers**, similar to **Access Certification Admins** or **Admins**, can be set as the Default Reviewer. This is the standard entitlement to provide to someone who needs to perform the Review portion of an Access Review. Managers can also submit Mover and Leaver forms for their direct reports when Lifecycle Management forms are in use.

### Base User

**Base User** is automatically granted and simply enables the ability for the Identity to log into the platform. An Identity without **Base User** cannot log in at all, even with SSO. See below about the **Grant Clarity Login** button.

### End User

**End User** is automatically granted as described below, and provides the lowest level of access within Clarity. This entitlement primarily grants access to the Self Service Portal / Access Hub.

### Identity Manager

**Identity Manager** is a delegated role for people who onboard and offboard Identities without being full Admins. It is granted manually by an Admin. An Identity Manager can view every Identity, add a new Identity through the onboarding form, edit an Identity's core attributes, deactivate or reactivate an Identity, and view all form submissions. They cannot edit their own record or any Identity linked to their own, and they have no access to Settings, Reports, Access Reviews, Workflows, or ABAC.

## Granting Access

### Grant Clarity Login

When you click the **Grant Clarity Login** button depicted below (this is found on the Identity page for the individual user), this enables the account to Login by granting them the **Base User** and **End User** entitlements. If the Identity is assigned any Access Review items, the **Manager** entitlement is granted at the same time. ![Grant Clarity Login](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Grant%20Clarity%20Login.png?sv=2026-02-06&spr=https&st=2026-11-12T15%3A47%3A11Z&se=2026-11-12T16%3A47%3A11Z&sr=c&sp=r&sig=q%2FEbn4%2FHsfeGMdvoFS8Mj8p0EYdCeHvIcs3Tx%2FPt3Vs%3D)

Password

An email will be sent to the email address for the Identity prompting them to reset the password for your account.

The article below walks you through that process. [How to Reset your Password](/docs/how-to-reset-your-password)

### Login with SSO

If you have SSO correctly configured for Clarity:

1. User attempts to log in to Clarity, which redirects to the SSO provider of your choice.  The user enters their credentials into this service.
2. SSO Provider either approves or denies the login attempt (based on group membership in SSO Provider), and tells Clarity whether the login was successful. If successful, then the process continues to steps 3 and 4.
3. On the first login, Clarity creates the login account and links it to the Identity.
4. On every login, as long as the Identity is active, Clarity makes sure the **Base User** and **End User** entitlements are present, and grants the **Manager** entitlement if the Identity is assigned any Access Review items (past or present).

Removing Manager from an SSO user

Because step 4 runs on every SSO login, removing the **Manager** entitlement from an Identity that still has Access Review items assigned to them will not stick; it is granted again the next time they log in. Reassign their review items first if the Manager entitlement needs to be removed.

---

## Need help?

If you have any problems, contact your customer success team. You can also get in touch with our general support [via email](mailto:support@claritysecurity.io), open a [support ticket](https://support.claritysecurity.com/home). Our general support team is available Monday - Friday from 8:00 AM - 6:30 PM CST.

A Downstream Application is any application that supplies Clarity with service users, entitlements, and attributes.