--- title: "High-Risk Tagged Entitlement Review" slug: "high-risk-entitlement-review" description: "This guide walks you through a critical access control process: reviewing Entitlements we have identified and marked as High Risk." updated: 2026-06-16T19:34:19Z published: 2026-06-16T19:34:19Z canonical: "help.claritysecurity.com/high-risk-entitlement-review" --- > ## Documentation Index > Fetch the complete documentation index at: https://help.claritysecurity.com/llms.txt > Use this file to discover all available pages before exploring further. # High-Risk Entitlements Review: A Comprehensive Guide This guide walks you through a critical access control process: reviewing Entitlements we have identified and marked as High Risk. Before you begin Learn more about defining High Risk Entitlements in our article: [What are Entitlements?](/v1/docs/what-are-entitlements) --- ## What's Included in This Review? This review targets Entitlements we have identified as having significant access privileges, often assigned to administrators or other privileged users. The Access Review will be made up of these High Risk Entitlements from multiple applications. --- ## Creating and Managing Reviews Learn more About Access Reviews here: [What are Access Reviews?](/v1/docs/what-are-access-reviews) ![Creating a High Risk Access Review](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/SCR-20240509-jakv-2.png?sv=2026-02-06&spr=https&st=2026-11-14T04%3A34%3A21Z&se=2026-11-14T05%3A34%3A21Z&sr=c&sp=r&sig=%2FV7HzGTMhOyghLSTnzsYpky2fPlvFM5ng%2Fqtld6h%2BjA%3D) #### 1. Assigning Ownership and Setting Review Frequency We are going to assign the review to the Entitlement Owners, if we have them set. If not, we will have Clarity assign the review items to the default reviewer, so they can reassign them appropriately. We will also set the frequency as quarterly to make sure we're on top of reviewing these items, and give the reviewers 10 business days to complete their review. #### 2. Reviewing and Approving Entitlements Due to our review being for High Risk entitlements, we want to ensure that they are properly reviewed and not a victim of Rubber Stamping. For this reason, we will set the Risk Threshold to 0. #### 3. Selecting Entitlements for Review For our review type we will choose **High Risk Entitlements**, as we have gone through our Entitlements and designated them as High Risk. If there were any Applications we wanted to exclude from the review we could define those in the **Add Exclusions** option. In our case, we do not want to exclude anything for our review. #### 4. Additional Considerations: We select the option to include the friendly names for Entitlements we have configured. **Include Inherited Entitlements** ensures we review nested access granted by high risk entitlements, providing a complete picture. Finally, we're going to select the option to **Delay email notification for assignees** so we can reassign items before communicating to the reviewers they have assigned items. ### Reassigning and Emailing When we select **Save** or **Update**, our review will be generated. We will see a blue note at the top of the screen informing us that the review is currently generating. Depending on the size, it may take some time to process and generate the review, but after refreshing the screen we see it listed if it has completed. For our review, we will select the **Actions** dropdown and then **View All Items** so we can review all the assignments for this review. ![Access Review Action Menu](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/SCR-20240509-iwlg.png?sv=2026-02-06&spr=https&st=2026-11-14T04%3A34%3A21Z&se=2026-11-14T05%3A34%3A21Z&sr=c&sp=r&sig=%2FV7HzGTMhOyghLSTnzsYpky2fPlvFM5ng%2Fqtld6h%2BjA%3D) We will select the items we want to reassign and then, in the popup, search for who we are going to assign these items to. Because we have not yet sent the emails for this review, the new assignee will not be notified until we select that option from the **Actions** dropdown menu. ![Reassigning an Access Review Item](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/image%28431%29.png?sv=2026-02-06&spr=https&st=2026-11-14T04%3A34%3A21Z&se=2026-11-14T05%3A34%3A21Z&sr=c&sp=r&sig=%2FV7HzGTMhOyghLSTnzsYpky2fPlvFM5ng%2Fqtld6h%2BjA%3D) Note Any reassignments that occur after selecting the **Email Assignees** option for your review will send an email to the new assignee. ### Upcoming Reviews and Archived Templates ![Configuring Review Frequency](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/SCR-20240509-jahx-2.png?sv=2026-02-06&spr=https&st=2026-11-14T04%3A34%3A21Z&se=2026-11-14T05%3A34%3A21Z&sr=c&sp=r&sig=%2FV7HzGTMhOyghLSTnzsYpky2fPlvFM5ng%2Fqtld6h%2BjA%3D) Due to setting the frequency to quarterly, the next **High Risk Entitlement Review** is scheduled for 90 days after launch. We can adjust the review template from the "Upcoming" tab if we need to make any changes. By following these steps, we can effectively manage high risk entitlements and ensure a robust access control environment. --- ## Review Process Now that we have reassigned the review items as needed, it's time for us to review the remaining items we are responsible for. In the **Actions** dropdown for the Access Review, first we will select **Email Assignees**, then select **Review My Items** to start completing your assigned items. When we open the review, Clarity will automatically expand the context for review items to give us a full picture of what we are reviewing. We can toggle this in the top right using the **Auto Expand** option. ![expanded review context and auto expand toggle](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/image%28436%29.png?sv=2026-02-06&spr=https&st=2026-11-14T04%3A34%3A21Z&se=2026-11-14T05%3A34%3A21Z&sr=c&sp=r&sig=%2FV7HzGTMhOyghLSTnzsYpky2fPlvFM5ng%2Fqtld6h%2BjA%3D) As we review items, they will be hidden when we take an action on them. This behavior can be changed by toggling the option for **Hide Completed** in the top right of the UI. You will notice that after you **Approve (1)** or **Deny (2)** access, the button changes to show that action has been taken on that row. ![unhidden completed](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/image%28433%29.png?sv=2026-02-06&spr=https&st=2026-11-14T04%3A34%3A21Z&se=2026-11-14T05%3A34%3A21Z&sr=c&sp=r&sig=%2FV7HzGTMhOyghLSTnzsYpky2fPlvFM5ng%2Fqtld6h%2BjA%3D) When we deny access there will be a popup prompting us for a reason of **No Longer Needs Access** or **Access is Inappropriate**, select whichever is appropriate for the situation. Both of these options will prompt for deprovisioning of the access, but are listed with their specific reason on reports. ![Deny Access popup modal](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/image%28432%29.png?sv=2026-02-06&spr=https&st=2026-11-14T04%3A34%3A21Z&se=2026-11-14T05%3A34%3A21Z&sr=c&sp=r&sig=%2FV7HzGTMhOyghLSTnzsYpky2fPlvFM5ng%2Fqtld6h%2BjA%3D) We've gone through a few of the items and approved and denied, but now we want to Rubber Stamp the remaining items to make this quick. Due to the Risk Threshold being set to 0 in the template, we will be unable to **Approve Selected** or **Deny Selected**, which we can see that in the following screenshot. This shows our number of selected items, the threshold for our ability to Approve or Deny Selected items in bulk, and the number of selected items that will be approved or denied if they meet the criteria. ![bulk approve or deny popup modal](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/image%28434%29.png?sv=2026-02-06&spr=https&st=2026-11-14T04%3A34%3A21Z&se=2026-11-14T05%3A34%3A21Z&sr=c&sp=r&sig=%2FV7HzGTMhOyghLSTnzsYpky2fPlvFM5ng%2Fqtld6h%2BjA%3D) Once we have approved or denied all the items assigned to us, our part in reviewing is complete and it's ready to be remediated. --- ## Remediation Process ![Access Review Remediation Options](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/SCR-20240507-iptw.png?sv=2026-02-06&spr=https&st=2026-11-14T04%3A34%3A21Z&se=2026-11-14T05%3A34%3A21Z&sr=c&sp=r&sig=%2FV7HzGTMhOyghLSTnzsYpky2fPlvFM5ng%2Fqtld6h%2BjA%3D) Remediation may be required when an access denial for a user occurs on the review. The system will deprovision, delete, or deactivate access as relevant. If you have Provisioning enabled in both your Clarity tenant, and the respective applications, we can choose **Auto Deprovision**. If you are not using Clarity for Lifecycle Management (LCM), you can select **Manually Deprovision**. The status will then be **Pending Manual Remediation** until the application syncs and Clarity's workflow to update Remediated items are complete. It will then be listed as **Remediation Complete**. Once either of those processes is complete, and there are not outstanding items, we can **Finalize** our review in the **Ready to Finalize** tab of the Access Reviews. ![Access Review Action Menu](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/SCR-20240510-jubf-2.png?sv=2026-02-06&spr=https&st=2026-11-14T04%3A34%3A21Z&se=2026-11-14T05%3A34%3A21Z&sr=c&sp=r&sig=%2FV7HzGTMhOyghLSTnzsYpky2fPlvFM5ng%2Fqtld6h%2BjA%3D) After reviews are **Finalized**, we will find them in the **Completed** tab. At this stage we can select the **View All** or **Export** options for a review, but no further changes can be made to the review items. --- ## Helpful Information and Articles - [What are Access Reviews?](/v1/docs/what-are-access-reviews) - [User Access Review Types](/home/docs/access-review-types) - [Active Identity Access Reviews](/home/docs/active-identity-reviews) - [Example Emails from Access Reviews](/v1/docs/example-emails-from-access-reviews) - [Access Review Reminder](/v1/docs/access-review-reminder) - [What are Entitlements?](/v1/docs/what-are-entitlements) --- ## Need help? If you have any problems, contact your customer success team. You can also get in touch with our general support [via email](mailto:support@claritysecurity.io), open a [support ticket](https://support.claritysecurity.com/home). Our general support team is available Monday - Friday from 8:00 AM - 6:30 PM CST. An Entitlement is an assignable permission found in a downstream application. Common examples include licenses, groups, and policies. High-Risk is flag used to denote Entitlements or Roles that have an elevated level of risk and require additional attention and review. Entitlements: - **Entitlements** > **Filter by App** > **Choose Entitlement** > **Gear Icon** - **Entitlements** > **Bulk Edit** > **High Risk Column** Roles: - **Roles** > **Click your Role** > **Manage** > **Gear Icon** - **Roles** > **Bulk Edit** > **High Risk Column** Access Review, also known as Access Attestation, Access Certification, or User Access Review, is the process of reviewing the appropriateness of the entitlements assigned to a service user in a downstream application. An Entitlement Owner is a Clarity Identity responsible for entitlement specific self-service access requests and User Access Reviews. Ways to configure: - **Entitlements** > **Pick an Entitlement** > **Click Gear Icon** (top right). - **Entitlements** > **Bulk Edit** > **Owner Column** Approve automatically without further review. A value between 0 and 100, with higher numbers representing an increased risk of material impact on your institution. An entitlement granted as part of a parent entitlement, but not directly assigned. Bulk approve or deny access without thorough review. Lifecycle Management refers to the processes that handle an employee's journey from on-boarding to off-boarding. This can also be defined by the terms Joiner, Mover, and Leaver. ## Related - [Dashboards](/dashboards.md)