Mar 18, 2025
•
Resources
Discover how Access Rules streamline ABAC, prevent “SCIM-cidents,” and reduce manual overhead for modern security teams.
At Opal, we partner closely with our customers: from security leaders in charge of reducing risk and overprovisioned access, to IAM and IT teams with mandates to implement identity governance across their organizations. As companies grow, these teams must adapt their strategies to keep threat models current and processes efficient. With every employee who joins, moves, or leaves, manual updates might suffice for a small team of five, but become cumbersome when onboarding 50 new hires, converting a class of 20 interns to full-time, or offboarding multiple contractors at once. Over time, this manual approach not only burdens administrators, but it also creates opportunities for mistakes and unintended permissions.
The complexity increases when juggling numerous IDPs and HR systems, often owned by separate departments, with multiple environments (production, staging, dev) for each. For instance, HR may rely on Workday for user data, which flows downstream to IT’s Entra and Okta – yet neither team may anticipate how changes to a user’s profile could trigger unexpected, cascading modifications. Without a single source of access truth, attempts to automate can easily grant users more permissions than they need. Teams often believe they must choose between between usability and security – but at Opal, we ask: why not have both?
Opal Access Rules was built with all of these customer pains in mind: it enables dynamic access management at scale, and does so in a way that is compatible with security best practices.
What are Access Rules?
Access Rules are sets of conditions — built from attributes from your IDP or HRIS source — you can use to dynamically grant access to groups and resources, enabling Attribute-Based Access Control (ABAC). With Access Rules, you can easily enforce policies at scale and adapt your access requirements to changing business logic, without additional overhead.
Access Rules use IDP or HRIS attributes to dynamically grant group and resource access, enabling ABAC.
Access Rules are especially useful for managing Joiner, Mover, and Leaver (JML) workplace events. For example, you can create an access rule that selects users with the department:engineering attribute and apply it to an Okta Group or Github repository.
Joiner: When a new engineer joins the company, they’ll automatically be granted access to the Okta Group and Github Repository.
Mover: If the user moves departments, the rule no longer applies, and they will no longer have access to the groups and resources.
Leaver: Similarly, if they leave the company, they will lose access to both
Access Rules, used in tandem with Opal’s other least privilege features, allow admins to identify the root causes of overprovisioned access by understanding exactly how a user got access to a resource in the first place. We explicitly track direct access (e.g. via just-in-time) and indirect access (e.g. through groups or Access Rules) separately. This level of granularity enables admins to then systematically remediate risky access paths and optimize for more secure rule definitions.
Opal tracks direct (e.g., JIT) vs. indirect (e.g., groups or Access Rules) access separately, enabling admins to remediate risky paths and refine secure rule definitions.
Access Rules help customers codify intended access changes while also preventing unintended changes. Many customers have shared painful stories of “SCIM-cidents” resulting from unexpected upstream changes — HR accidentally changed a department name of Workday, or finance accidentally deleted a cost center in Okta — leading to cascading access changes and bulk revocations. As such, Opal’s Access Rules was designed to allow admins to opt-in to a “Failsafe” setting where Opal alerts them and prompts them to review bulk access changes.
Access Rules codify intended access changes while preventing “SCIM-cidents” from unexpected updates. With the Failsafe setting, Opal alerts admins to review bulk changes before they’re applied.
Key benefits
Reduce manual overhead: Access Rules are automatically updated when attributes are changed, so admins don’t need to spend time syncing state between IDP/HRIS systems and Opal.
Reduce drift and sprawl from desired access states: Access Rules operate as the source of truth for Opal access grants, reducing drift and sprawl between your IDP/HRIS system and actual user access.
Codify complex governance requirements: Access Rules let you codify complex conditionals into a single rule, letting you centralize logic for user access.
Identify and remediate root causes of overprovisioned access: Access Rules allows you to separately track just-in-time, temporary access from longstanding, birthright access.
Get Started with Opal Access Rules
Import attributes from your IDP/HRIS: These attributes — full-time employee status, department, etc. — are used as the sources for the conditional logic for your Access Rules.
Define access rules: Use conditional logic to define your access rule. For example, you can create a rule composed of employees tagged with “engineering” and “U.S.” and add a clause to exclude employees tagged with “part-time”.
Add groups and resources: After you construct your rule, you can grant it access to groups and resources, the same way you grant user and group access. When a new user joins and is tagged with an attribute affected by a rule, they’re automatically granted access to the resource.
[Optional] Pause/Reactivate Access Rule: You can pause an access rule if you do not wish for new changes to be effective. When you reactivate an access rule, Opal will recompute any membership changes, ask for confirmation, and apply the access changes.
[Optional] Use Access Rules with Request Configurations: You can also use access rules to dynamically enforce which users can request access to resources. First, create an Opal Group, then create an Access Rule to conditionally manage the group’s membership. On the resource, navigate to Edit > Request Configuration > Add New Request Configuration, and select the Opal Group that is now being managed by Access Rules.
To view the list of Access Rules you have set up, go to Inventory > Access Rules in the Opal dashboard. See the documentation for more details, and reach out if you have questions or feedback!
Coming soon for Access Rules
Access Rules Public API/Terraform support
Improved Access Rules UX and preview capability
Interested in more? Reach out!