Custom User Level Matrices
Custom user levels provide least privileged access that is unique to your specific tenant. If your organization has Custom User Levels, these may be built from various access permissions, identity permissions, and connections permissions, as detailed below.
Access Permissions
The following permissions are related to access.
| Access Profiles Read Only | Access Profiles Management | Roles Read Only | Roles Management | Entitlements Read Only | Entitlements Management | AIC Reader | AIC Author | |
| Access Profiles | View | ✓ | ✓ | Create | ✓ | Manage | ✓ | Delete | ✓ |
| Roles | View | ✓ | ✓ | Create | ✓ | Manage | ✓ | Delete | ✓ |
| Entitlements | View | ✓ | ✓ | Create | ✓ | Manage | ✓ | Delete | ✓ |
| Access Intelligence Center | View | ✓ | ✓ | Filter | ✓ | ✓ | Export | ✓ | ✓ | Create | ✓ | Modify | ✓ | Manage | ✓ | Delete | ✓ |
Identity Permissions
The following are identity read-only permissions.
| Identity Read Only | Identity Details | Identity Events | Identity Accounts | Identity Access | Work Reassignment | View Identity Details | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | View Identity Events | ✓ | ✓ | View Identity Accounts | ✓ | ✓ | View Identity Access | ✓ | ✓ | View Work Reassignment | ✓ | ✓ |
The following are identity management permissions.
| Identity Management | Identity Accounts Management | Revoke Identity Access | Enable Identity | Delete Identity | Invite Identity | Export Identity List | Export Identity Events | Set Lifecycle State | Add and Delete Work Reassignment | Process Identity | Reset Identity | Set User Levels | Reset MFA | Disable Identity | Synchronize Attributes | Reset Password | View Identities | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | Manage Identities | ✓ | Delete Identities | ✓ | ✓ |
| Account Attributes and Objects for Identity Accounts | View | ✓ | ✓ | Manage | ✓ | ✓ | Remove | ✓ | ✓ | ||||||||
| Access to Entitlements, Roles, and Access Profiles | Revoke | ✓ | ✓ | ||||||||||||||
| Identity Functions (with Read Only for Identities) | Enable Identities | ✓ | ✓ | Invite Identities | ✓ | ✓ | Export Identity List | ✓ | ✓ | Export System Activity Events | ✓ | ✓ | Change a Lifecycle State | ✓ | ✓ | Add and Delete Work Reassignment | ✓ | ✓ | Process Identity | ✓ | ✓ | Reset Identity | ✓ | ✓ | Reset Password | ✓ | ✓ | Reset MFA | ✓ | ✓ | Set User Levels | ✓ | ✓ | Synchronize Attributes | ✓ | ✓ | Disable Identity | ✓ | ✓ |
The following are additional identity permissions.
| Identity Access History Read Only | Human and Uncorrelated Accounts Read Only | Human and Uncorrelated Accounts Management | |
| Access History Page | View | ✓ | |
| Human and Uncorrelated Accounts | View | ✓ | ✓ | Manage | ✓ | Remove | ✓ | Delete | ✓ |
Connections Permissions
The following permissions are related to connections.
| VA Read Only | VA Management | |
| Virtual Appliances | View | ✓ | ✓ | Create | ✓ | Manage | ✓ | Delete | ✓ |
Identity Graph Permissions
The following permissions are related to Identity Graph.
| Identity Graph Admin | Identity Graph Read Only | |
| Identity Graph | View | ✓ | ✓ | Export Data | ✓ | ✓ | Create Snapshots | ✓ | ✓ | Actions | ✓ |
Governance Group Permissions
Some governance group permissions require that additional permissions are in place before they can be granted.
Prerequisites are:
- Governance Group Management - Requires Identity Accounts, which grants read-only access to identity accounts and identity details. This is required so the user can see a list of available accounts that can be added as members of the group.
- Governance Group Membership Management - Requires Governance Group Read Only so they can access and view the Governance Group list itself, and Identity Accounts so they can see the list of available accounts that can be added as members of the group
- Governance Group Read - No prerequisites. This permission functions independently.
The following permissions are related to governance groups.
| Governance Group Management | Governance Group Membership Management | Governance Group Read | |
| Governance Groups | View | ✓ | ✓ | ✓ | Add members | ✓ | ✓ | Remove members | ✓ | ✓ | Create groups | ✓ | Update groups | ✓ | Delete groups | ✓ |
SailPoint Agentic Fabric (SAF) Permissions
The following permissions are related to SailPoint Agentic Fabric.
| SAF Admin Write | SAF Agent Audit | SAF Prompt Security Management | SAF Prompt Security Read | |
| SAF Admin | View | ✓ | Create | ✓ | Update | ✓ | Delete | ✓ |
| SAF Audits | View | ✓ | Create | ✓ | Update | ✓ | Delete | ✓ |
| MIS Identity Access | View | ✓ | Delete MIS agents | ✓ |
| Machine Identity Lifecycle Actions | Manage | ✓ | ||
| Business Applications | Manage | ✓ |
Separation of Duties (SoD) Permissions
The following are Separation of Duties permissions.
| SoD Policy Read Only | SoD Control Read Only | SoD Violation Read Only | SoD Policy Management | SoD Control Management | SoD Violation Management | View Separation of Duties Policies | ✓ | ✓ | View Separation of Duties Controls | ✓ | ✓ | ✓ | View Separation of Duties Violations | ✓ | ✓ | ✓ | Manage Separation of Duties Policies | ✓ | Manage Separation of Duties Controls | ✓ | Manage Separation of Duties Violations | ✓ | View Separation of Duties Policy Definitions from Violations | ✓ |
Workflow Permissions
The following permissions are related to Workflows.
| Workflows View Configurations and Execution History | Workflows Read Only | Workflows Audit Read Only | |
| Workflow Configurations | View | ✓ | ✓ | ✓ |
| Workflow Executions | View Execution History | ✓ | ✓ |
Caution
- PII compliance: HTTP Action input headers may contain sensitive authentication data (for example, tokens or keys) and may include PII. Treat these headers as sensitive and document handling requirements. Refer to Access Request Actions for more information.
- Workflows Read-Only users (without Search permissions) cannot use the Search API to retrieve workflow execution history.
- Workflows Read-Only users with additional Search permissions can view Search UI (including tabs) and make backend Search API calls.
- Search permissions do not replace Workflow API authorization; execution-history Workflow APIs still require the Workflows Audit Read Only permission.
Documentation Feedback
Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.