# Policy Center Overview

The Policy Center serves as SailPoint's centralized policy administration point. It is the single place for the authoring, management, versioning, and deployment of fine-grained access and security policies across your organization. Policies are composed of information that includes the policy's purpose, ownership, and behavior, as defined by specific rules you put in place. Policies continuously monitor, evaluate, and enforce these defined business and security rules against each identity to detect and prevent compliance violations.

The Policy Center supports [Just-In-Time (JIT) Activation](#just-in-time-activation), [Just-In-Time (JIT) Duration](#just-in-time-duration), [Gateway Access](#gateway-access), and [Endpoint Agent AuthZ](#endpoint-agent-authz) policies. Each policy type has its own section in the left navigation, and related sections are grouped together. For example, there is a JIT group and an Agentic group. Each group is independently gated. Different tenants, and different admins within a tenant, might see different sections.

## Policy Evaluation

Every policy type follows the same evaluation flow. What differs per type is the input, which criteria attributes exist, what a match means, and how multiple matches are combined. The following is true across all types of policies:

- A disabled policy is never evaluated. If you want to include the policy, it must be in an Enabled state.
- Context includes both input data and real-time context, such as risk or other data retrieved from the Policy Information Point.
- Each policy's criteria are an AND/OR of groups, and each group is an AND/OR of items. A policy matches when the criteria test True. Some policy types have an option available to enforce case sensitivity. String comparisons are case-insensitive unless the author chooses to opt into case sensitivity on an item.
- Each policy evaluation records which configuration was used, for audit purposes.
- Each policy type has an [aggregator](#aggregators) that combines matching policies into one answer.
- Evaluation results are audited and include a summary of the outcome.

## Aggregators

| Policy Type | Aggregator | Combination rule |
| --- | --- | --- |
| JIT Activation | `concatenate` | All matches are returned; their frictions accumulate |
| JIT Duration | `min-durations` | Element-wise minimum of every duration field across matches |
| Gateway Access | `any-match` | Any match is Allowed; no matches are Denied |
| Endpoint Agent AuthZ | `any-deny` | Any match is Denied; no matches are Allowed |

### Just-In-Time Activation

A Just-In-Time (JIT) Activation policy is an identity security and access management framework where users or systems are granted access permissions only when needed, and only with the minimum level of privilege necessary to complete a specific task. For more information, refer to [Managing Just-In-Time Activation Policies](jit_activation.md).

### Just-In-Time Duration

A Just-In-Time (JIT) Duration policy is an identity security and access management framework where users or systems are granted access permissions only for the duration required, and only with the minimum level of privilege necessary to complete a specific task. For more information, refer to [Managing Just-In-Time Duration Policies](jit_duration.md).

### Gateway Access

A Gateway Access policy is a security control rule enforced at a network gateway. It acts in real time to filter and manage incoming and outgoing requests and data for your environment before access is granted. For more information, refer to [Managing Gateway Access Policies](gateway_access.md).

### Endpoint Agent AuthZ

An Endpoint Agent AuthZ policy is a set of runtime security rules that controls what an autonomous AI agent or software workload is allowed to access. It acts in real time to filter and manage incoming and outgoing requests and data for your environment before access is granted. For more information, refer to [Managing Endpoint Agent AuthZ Policies](endpoint_agent_authz.md).

<!--
Tentative GA date for below is 11/2/26
### Access Request

An Access Request policy is a set of governance rules, workflows, and guardrails that determine who can request access to specific applications, data, or systems, how those requests are approved, and what security checks must be passed before access is granted.

For more information, refer to the [Access Request Overview](../requests/index.md).
-->

Policy Center Overview

The Policy Center serves as SailPoint's centralized policy administration point. It is the single place for the authoring, management, versioning, and deployment of fine-grained access and security policies across your organization. Policies are composed of information that includes the policy's purpose, ownership, and behavior, as defined by specific rules you put in place. Policies continuously monitor, evaluate, and enforce these defined business and security rules against each identity to detect and prevent compliance violations.

The Policy Center supports Just-In-Time (JIT) Activation, Just-In-Time (JIT) Duration, Gateway Access, and Endpoint Agent AuthZ policies. Each policy type has its own section in the left navigation, and related sections are grouped together. For example, there is a JIT group and an Agentic group. Each group is independently gated. Different tenants, and different admins within a tenant, might see different sections.

Policy Evaluation

Every policy type follows the same evaluation flow. What differs per type is the input, which criteria attributes exist, what a match means, and how multiple matches are combined. The following is true across all types of policies:

A disabled policy is never evaluated. If you want to include the policy, it must be in an Enabled state.
Context includes both input data and real-time context, such as risk or other data retrieved from the Policy Information Point.
Each policy's criteria are an AND/OR of groups, and each group is an AND/OR of items. A policy matches when the criteria test True. Some policy types have an option available to enforce case sensitivity. String comparisons are case-insensitive unless the author chooses to opt into case sensitivity on an item.
Each policy evaluation records which configuration was used, for audit purposes.
Each policy type has an aggregator that combines matching policies into one answer.
Evaluation results are audited and include a summary of the outcome.

Aggregators

Policy Type	Aggregator	Combination rule
JIT Activation	`concatenate`	All matches are returned; their frictions accumulate
JIT Duration	`min-durations`	Element-wise minimum of every duration field across matches
Gateway Access	`any-match`	Any match is Allowed; no matches are Denied
Endpoint Agent AuthZ	`any-deny`	Any match is Denied; no matches are Allowed

Just-In-Time Activation

A Just-In-Time (JIT) Activation policy is an identity security and access management framework where users or systems are granted access permissions only when needed, and only with the minimum level of privilege necessary to complete a specific task. For more information, refer to Managing Just-In-Time Activation Policies.

Just-In-Time Duration

A Just-In-Time (JIT) Duration policy is an identity security and access management framework where users or systems are granted access permissions only for the duration required, and only with the minimum level of privilege necessary to complete a specific task. For more information, refer to Managing Just-In-Time Duration Policies.

Gateway Access

A Gateway Access policy is a security control rule enforced at a network gateway. It acts in real time to filter and manage incoming and outgoing requests and data for your environment before access is granted. For more information, refer to Managing Gateway Access Policies.

Endpoint Agent AuthZ

An Endpoint Agent AuthZ policy is a set of runtime security rules that controls what an autonomous AI agent or software workload is allowed to access. It acts in real time to filter and manage incoming and outgoing requests and data for your environment before access is granted. For more information, refer to Managing Endpoint Agent AuthZ Policies.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.