# Effective Privilege

Effective privilege is the calculated privilege level of an access object after direct privilege and inherited privilege are considered.

Effective Privilege helps:

- Identify entitlements that inherit a higher privilege level from a parent entitlement.
- Govern nested access based on the privilege an entitlement actually grants.
- Surface overall privilege to admins, certification reviewers, and users.

## Understanding Entitlement Effective Privilege

Each entitlement has a direct privilege level and an inherited privilege level.

Direct privilege is the level assigned to the entitlement through [Privilege Classification](privilege_classification.md). Direct privilege is assigned so that known privileged entitlements are classified as privileged.

Inherited privilege comes from parent entitlements. Child entitlements often inherit privilege from their parents. Inheritance can continue through nested ancestors, resulting in an entitlement receiving a higher privilege level from a parent than the level assigned directly through classification.

Entitlement Effective Privilege flows down from parent to child, and is calculated as the higher of the entitlement's direct privilege level and all inherited privilege levels.

## Understanding Roles and Access Profiles Effective Privilege

Roles and Access Profiles privilege is inherited from child entitlements and child access profiles.

The effective privilege flows up from members to the holding container, and is calculated as the highest effective privilege level of the entitlements or access profiles they contain. The calculation continues through nested entitlements and access profiles.

## Effective Privilege Levels

Effective privilege reflects the overall access an access object grants, including privilege inherited from parent access objects. An access object's effective privilege level is classified based on the potential impact that misuse or compromise may have.

| Effective Privilege Level | Description |
| --- | --- |
| High |<p>The access object grants administrative access to infrastructure systems, such as operating systems, databases, platforms, or backup systems. Access is typically used for administrative and break-fix activities rather than day-to-day user work. Also represents the highest level of access inside an application, such as an application global admin role.</p><p>These access objects pose the greatest risk and require monitoring.</p> |
| Medium | The access object grants administrative access but is not at the highest level. Access allows a subset of administrative tasks for a specific role or function and may provide access to data or services. |
| Low | The access object does not grant administrative access. Provides access to data that may require special attention. |
| None |The access object is not used for application access. Access objects with an effective privilege level of None are not classified as privileged. |

Effective Privilege

Effective privilege is the calculated privilege level of an access object after direct privilege and inherited privilege are considered.

Effective Privilege helps:

Identify entitlements that inherit a higher privilege level from a parent entitlement.
Govern nested access based on the privilege an entitlement actually grants.
Surface overall privilege to admins, certification reviewers, and users.

Understanding Entitlement Effective Privilege

Each entitlement has a direct privilege level and an inherited privilege level.

Direct privilege is the level assigned to the entitlement through Privilege Classification. Direct privilege is assigned so that known privileged entitlements are classified as privileged.

Inherited privilege comes from parent entitlements. Child entitlements often inherit privilege from their parents. Inheritance can continue through nested ancestors, resulting in an entitlement receiving a higher privilege level from a parent than the level assigned directly through classification.

Entitlement Effective Privilege flows down from parent to child, and is calculated as the higher of the entitlement's direct privilege level and all inherited privilege levels.

Understanding Roles and Access Profiles Effective Privilege

Roles and Access Profiles privilege is inherited from child entitlements and child access profiles.

The effective privilege flows up from members to the holding container, and is calculated as the highest effective privilege level of the entitlements or access profiles they contain. The calculation continues through nested entitlements and access profiles.

Effective Privilege Levels

Effective privilege reflects the overall access an access object grants, including privilege inherited from parent access objects. An access object's effective privilege level is classified based on the potential impact that misuse or compromise may have.

Effective Privilege Level	Description
High	The access object grants administrative access to infrastructure systems, such as operating systems, databases, platforms, or backup systems. Access is typically used for administrative and break-fix activities rather than day-to-day user work. Also represents the highest level of access inside an application, such as an application global admin role. These access objects pose the greatest risk and require monitoring.
Medium	The access object grants administrative access but is not at the highest level. Access allows a subset of administrative tasks for a specific role or function and may provide access to data or services.
Low	The access object does not grant administrative access. Provides access to data that may require special attention.
None	The access object is not used for application access. Access objects with an effective privilege level of None are not classified as privileged.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.