Skip to main content
Access policies define the rules governing who can request access and under what conditions. Each policy controls eligibility, attaches an approval template that routes requests to the right approvers, and sets constraints like how long access lasts and whether a business justification is required.Policies are the middle layer of the cascade: an approval template attaches to a policy, and a policy attaches to one or more access levels. Create the approval template first, then the policy, then attach the policy when you configure an access level.

​
What policies provide

Eligibility control

Define which user groups can (or cannot) request access under this policy.

Approval routing

Attach an approval template that defines who approves and in what order.

Access duration

Let requesters pick a duration, enforce a fixed one, or grant permanent access.

Business justification

Require requesters to explain why they need access.

​
Creating a policy

1

Navigate to Settings > Applications > Policies tab

2

Click New Policy

3

Configure policy details

  • Name: Descriptive name (e.g., “Standard access”, “Privileged access review”)
  • Description: When this policy should be used
  • Icon and color: Visual identifier for the policy
  • Owner: User responsible for managing this policy
4

Set eligibility

  • Eligible Groups: User groups allowed to request access under this policy. Leave empty to allow all users.
  • Ineligible Groups: User groups excluded from requesting access, even if they also belong to an eligible group.
5

Attach an approval template

Select an existing approval template, or leave empty for auto-approval. The template defines approval rounds, each round’s policy (any, all, or threshold), and its approvers. Create the template at Settings > Approval Templates if you have not already.
6

Set the access duration

Choose an Access Duration mode, which controls how long access granted under this policy lasts and whether requesters see a duration field at all. See access duration modes below.
7

Set the business justification requirement

Toggle Business Justification on to require requesters to explain their need.
8

Save the policy

​
Access duration modes

The Access Duration setting on a policy decides who controls the length of the grant. It also decides whether the request form shows a duration field, so you set expiry once on the policy rather than per form.
Duration values use short-form notation: m for minutes, h for hours, d for days. Combinations work too, such as 1d12h.

​
How the form adapts

The Duration and Business Justification fields on your access request form are policy-driven. They appear only for access levels whose policy calls for them, and when they appear they are required.
  • A requester picking an access level whose policy uses Fixed duration or No expiry never sees the Duration field.
  • A requester picking an access level whose policy leaves Business Justification off never sees that field.
  • When a field does render, the requester has to fill it in, so you do not need to mark it required on the form yourself.
This is what lets one form serve your whole catalog. Two people opening the same form, or the same person selecting two different access levels, see different fields.
When a policy uses Requester picks a duration and has a default duration set, the form preselects it as long as it is one of the offered options.

​
Linking policies to access levels

Policies are assigned to individual access levels, not to entire applications. A single policy can be shared across multiple access levels.When a user requests an access level, the linked policy determines eligibility and approval requirements. If no policy is linked to an access level, the request is auto-approved.

​
How policies connect to approval templates

An access policy references an approval template. When a request is submitted, Ravenna applies the template to the ticket automatically, materializing its rounds as concrete approval steps. Dynamic approvers in the template (the requester’s manager, application owner, and so on) are resolved at apply time. You do not need a workflow for this routing.
Learn about approval templates

​
Managing policies

Editing a policy only affects future requests. Existing in-flight requests retain the policy rules that were in place when they were submitted.Archiving hides the policy from new assignments while preserving history and existing entitlements that reference it.Deleting permanently removes the policy. Access levels that referenced it fall back to auto-approval.
Last modified on August 5, 2026