What policies provide
Eligibility control
Define which user groups can (or cannot) request access under this policy.
Approval routing
Attach an approval template for multi-round workflows, or pick approvers directly for a single inline round.
Access duration
Let requesters pick a duration, enforce a fixed one, or grant permanent access.
Business justification
Require requesters to explain why they need access.
Creating a policy
1
Navigate to Settings > Applications > Policies tab
2
Click New Policy
3
Configure policy details
- Name: Descriptive name (e.g., “Standard access”, “Privileged access review”)
- Description: When this policy should be used
- Icon and color: Visual identifier for the policy
- Owner: User responsible for managing this policy
4
Set eligibility
- Eligible Groups: User groups allowed to request access under this policy. Leave empty to allow all users.
- Ineligible Groups: User groups excluded from requesting access, even if they also belong to an eligible group.
5
Configure approvals
Under Approvals, choose how requests are approved. See approver modes for the two options and when to use each.
6
Set the access duration
Choose an Access Duration mode, which controls how long access granted under this policy lasts and whether requesters see a duration field at all. See access duration modes below.
7
Set the business justification requirement
Toggle Business Justification on to require requesters to explain their need.
8
Save the policy
Approver modes
The Approvals setting on a policy decides how the request is routed for review. Pick the mode that matches how you want to configure approvers.Either mode auto-approves when no approvers are configured. In template mode, that means leaving the template empty; in choose-approvers mode, that means clearing the approvers list.
Use an approval template
Pick this mode when you want a reusable, multi-round workflow (for example, manager approval, then security review). The template defines each round’s policy and approvers, and one template can back many access policies. Create templates at Settings > Approval Templates.Learn about approval templates
Choose approvers
Pick this mode when a single round of approval is enough and you do not need to maintain a separate template. You select users, user groups, or dynamic roles (such as the requester’s manager or the application owner) directly on the policy, then pick the round policy that decides when the round completes.The Approval policy options are the same as those on template rounds, minus Threshold:- Any can approve: the first approver to approve completes the round.
- Majority must approve: more than half of the approvers must approve.
- All must approve: every approver must approve.
Threshold is intentionally not available in this mode. Threshold needs an approver count that the inline form does not collect. If you need threshold routing, use an approval template instead.
Access duration modes
The Access Duration setting on a policy decides who controls the length of the grant. It also decides whether the request form shows a duration field, so you set expiry once on the policy rather than per form.Duration values use short-form notation:
m for minutes, h for hours, d for days. Combinations work too, such as 1d12h.The duration measures from when the entitlement is provisioned, not from when the request is submitted or approved. A
1d grant that takes four hours to approve still lasts a full day once access is granted.How the form adapts
The Duration and Business Justification fields on your access request form are policy-driven. They appear only for access levels whose policy calls for them, and when they appear they are required.- A requester picking an access level whose policy uses Fixed duration or No expiry never sees the Duration field.
- A requester picking an access level whose policy leaves Business Justification off never sees that field.
- When a field does render, the requester has to fill it in, so you do not need to mark it required on the form yourself.
Linking policies to access levels
Policies are assigned to individual access levels, not to entire applications. A single policy can be shared across multiple access levels.When a user requests an access level, the linked policy determines eligibility and approval requirements. If no policy is linked to an access level, the request is auto-approved.How policies drive approvals
When a request is submitted, Ravenna creates the approval rounds on the ticket automatically based on the policy’s approver mode.- Template mode: Ravenna applies the referenced approval template, materializing its rounds as concrete approval steps. Dynamic approvers (the requester’s manager, application owner, and so on) are resolved at apply time.
- Choose approvers mode: Ravenna creates one inline round using the policy’s approvers and approval policy. Groups expand and dynamic roles resolve the same way as in template rounds.
Managing policies
Editing a policy only affects future requests. Existing in-flight requests retain the policy rules that were in place when they were submitted.Archiving hides the policy from new assignments while preserving history and existing entitlements that reference it.Deleting permanently removes the policy. Access levels that referenced it fall back to auto-approval.Learn about approval templates and approval rounds