---
title: "Trust Relationships and Permissions"
slug: "trust-relationships-and-permissions"
description: "Explanation of the Trust Relationship and Permissions settings within Clarity"
updated: 2024-11-14T15:23:36Z
published: 2024-11-14T15:23:36Z
canonical: "help.claritysecurity.com/trust-relationships-and-permissions"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.claritysecurity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Trust Relationships and Permissions

## What are Trust Relationships and Trust Permissions?

### Trust Relationship**:**

- **This is a source of truth**: Select this option for all your sources of truth which have some of your Identities. This is typically HR applications or enterprise Active Directory applications.
- **Recipient only (most SaaS apps)**: Apps like Zoom, or Salesforce, which do not act as a source of identities. This is a common selection for most SaaS applications. This will be the only option available for most SaaS applications.

### Trust Permission:

- **Read Only:** The application is only permitted to read the data from the application connection, no data is ever written back to the source.
- **Read + Provision/De-provision Entitlements (No User Creation):** Clarity is permitted to read information from the source as well as adding or removing access to Entitlements when users are hired or terminated, but will not create new Users in your applications.
- **Read + Provision/De-provision Entitlements and Users:** Clarity is permitted to read information from the source as well as adding or removing access to Entitlements when users are hired or terminated, and will create new Users in your applications where applicable.
- **Write:** Similar to Read + Provision/Deprovision above, however Clarity can also write Attributes back to the source.

---

## **Need help?**

If you have any problems, contact your customer success team. You can also get in touch with our general support [via email](mailto:support@claritysecurity.io), open a [support ticket](https://support.claritysecurity.com/home). Our general support team is available Monday - Friday from 8:00 AM - 6:30 PM CST.

Single Source of Truth:

Partial Source of Truth: Application which provides some of the identities for your organization.

Ex: HR platform, Azure Active Directory

Recipient only: Identities will not be created based on this source of truth.

Ex: Zoom, Slack

An identity is a single entity's (employee, contractor, service account) grouping of service users, attributes, and assigned entitlements.

**Read Only**: The application is only permitted to read the data from the application connection, no data is ever written back to the source.

**Read + Provision/Deprovision**: Clarity is permitted to read information from the source as well as adding or removing access to entitlements (when users are hired or terminated).

**Write**: Similar to Read + Provision/Deprovision above, however Clarity can also write attributes back to the source.

An Entitlement is an assignable permission found in a downstream application. Common examples include licenses, groups, and policies.

An attribute is a piece of information used to describe a service user, entitlement, or identity. Common examples include First Name, Last Name, Job Title, Department, etc.

## Related

- [Common App Configuration Steps](/common-app-configuration-steps.md)