--- name: performing-entitlement-review-with-sailpoint-iiq description: 'Performs entitlement review and access certification campaigns using SailPoint IdentityIQ including manager certifications, targeted entitlement reviews, role-based access validation, SOD violation remediation, and automated revocation workflows. Activates for requests involving access reviews, entitlement certifications, SailPoint IIQ governance, or periodic user access recertification. ' domain: cybersecurity subdomain: identity-access-management tags: - SailPoint - IdentityIQ - access-review - entitlement-certification - IGA - access-governance version: '1.0' author: Krishna Kumar (xalgord) license: Apache-2.0 nist_csf: - PR.AA-01 - PR.AA-02 - PR.AA-05 - PR.AA-06 --- # Performing Entitlement Review with SailPoint IdentityIQ ## When to Use - Quarterly or annual access certification campaigns are required for compliance (SOX, HIPAA, PCI-DSS) - Organization needs automated manager-based access reviews for all direct reports - Targeted entitlement reviews are needed for sensitive applications or high-privilege roles - Separation of Duties (SOD) violations must be identified and remediated - Orphaned accounts and excessive entitlements need to be discovered and cleaned up - Audit findings require evidence of periodic access review and remediation tracking **Do not use** for real-time access control decisions; IdentityIQ certifications are periodic review processes designed for governance and compliance validation. ## Coverage Gaps & Validation - **Rubber-stamping under default-revoke:** certifiers bulk-approve to avoid auto-revocation at campaign close. Query IdentityIQ `CertificationItem` decision times and flag reviewers averaging a few seconds per item or certifying 100% with zero revokes. - **Accounts outside aggregated cubes:** IIQ only certifies what its connectors aggregated. Apps with no connector, accounts that failed correlation, and local server accounts never appear — run the Uncorrelated Accounts and Orphan reports before trusting coverage. - **Service / non-human accounts excluded:** the `Filter.ne("type","service")` exclusion that keeps service accounts out of manager certs means they need a dedicated application-owner campaign; confirm one exists. - **Indirect entitlements via roles/nested groups:** entitlements inherited through business/IT roles or nested AD groups stay hidden unless `setIncludeAdditionalEntitlements(true)` and role-detail expansion are enabled. - **Shadow admin:** privilege held via API keys, app-local admin, or SPNs may not map to any IIQ managed entitlement. - **Validate completeness:** reconcile certification line-item counts against authoritative sources (HR for population, native AD/app exports for entitlements). Confirm revocations actually provisioned — verify the remediation workflow committed and did not silently create unworked manual work items. ## Prerequisites - SailPoint IdentityIQ 8.2+ deployed with database backend (Oracle, MySQL, or SQL Server) - Application connectors configured for all in-scope systems (Active Directory, LDAP, databases, SaaS applications) - Identity cubes aggregated with current entitlement data from all connected sources - Email server configured for certification notifications - Manager hierarchy defined in the identity model - Business roles and entitlement glossary populated for reviewer context ## Workflow ### Step 1: Define Certification Campaign Strategy Plan the certification scope and reviewer assignments: ```java // SailPoint IdentityIQ BeanShell - Campaign Configuration import sailpoint.object.*; import sailpoint.api.*; import java.util.*; // Define campaign schedule for quarterly manager certifications CertificationSchedule schedule = new CertificationSchedule(); schedule.setName("Q1-2026-Manager-Access-Review"); schedule.setDescription("Quarterly manager certification for all active employees"); schedule.setType(Certification.Type.Manager); // Configure campaign scope CertificationDefinition certDef = new CertificationDefinition(); certDef.setName("Q1 Manager Certification"); certDef.setOwner(context.getObjectByName(Identity.class, "cert-admin")); // Set certification options certDef.setCertifierSelectionType(CertificationDefinition.CertifierSelectionType.Manager); certDef.setIncludeEntitlements(true); certDef.setIncludeRoles(true); certDef.setIncludeAccounts(true); certDef.setIncludeAdditionalEntitlements(true); // Exclude service accounts from manager reviews Filter exclusionFilter = Filter.ne("type", "service"); certDef.setExclusionFilter(exclusionFilter); // Configure notification settings certDef.setNotificationEnabled(true); certDef.setReminderFrequency(7); // days certDef.setEscalationEnabled(true); certDef.setEscalationDays(14); certDef.setEscalationRecipient("security-governance-team"); // Set active period certDef.setActivePeriodDays(30); certDef.setAutoCloseEnabled(true); certDef.setDefaultRevoke(true); // Revoke if not reviewed context.saveObject(certDef); context.commitTransaction(); ``` ### Step 2: Configure Targeted Entitlement Certification Set up focused reviews for high-risk applications and privileged entitlements: ```java // Targeted certification for privileged access review import sailpoint.object.*; import sailpoint.api.*; CertificationDefinition targetedCert = new CertificationDefinition(); targetedCert.setName("Privileged Access Targeted Review"); targetedCert.setType(Certification.Type.ApplicationOwner); // Scope to specific high-risk applications List applicationNames = new ArrayList(); applicationNames.add("Active Directory"); applicationNames.add("AWS IAM"); applicationNames.add("Oracle EBS"); applicationNames.add("SAP GRC"); applicationNames.add("CyberArk Vault"); targetedCert.setApplicationNames(applicationNames); // Filter for privileged entitlements only String entitlementFilter = "entitlement.classification == \"Privileged\" " + "|| entitlement.riskScore > 800 " + "|| entitlement.name.contains(\"Admin\") " + "|| entitlement.name.contains(\"Root\") " + "|| entitlement.name.contains(\"DBA\")"; targetedCert.setEntitlementFilter(entitlementFilter); // Assign application owners as certifiers targetedCert.setCertifierSelectionType( CertificationDefinition.CertifierSelectionType.ApplicationOwner ); // Configure approval workflow targetedCert.setApprovalRequired(true); targetedCert.setSignOffRequired(true); targetedCert.setReasonRequired(true); // Enable SOD policy check during certification targetedCert.setCheckSodPolicies(true); targetedCert.setSodPolicyAction(CertificationDefinition.SodPolicyAction.Flag); context.saveObject(targetedCert); context.commitTransaction(); ``` ### Step 3: Implement SOD Policy Checks Within Certifications Define Separation of Duties policies that flag violations during reviews: ```java // Create SOD policy for financial system access conflicts import sailpoint.object.*; import sailpoint.object.Policy; Policy sodPolicy = new Policy(); sodPolicy.setName("Financial SOD - AP/AR Conflict"); sodPolicy.setType(Policy.TYPE_SOD); sodPolicy.setDescription("Prevents users from having both Accounts Payable " + "and Accounts Receivable access simultaneously"); sodPolicy.setViolationOwner( context.getObjectByName(Identity.class, "compliance-team") ); // Define conflicting entitlements SODConstraint constraint = new SODConstraint(); constraint.setName("AP-AR Separation"); // Left side: Accounts Payable entitlements PolicyConstraint leftSide = new PolicyConstraint(); leftSide.setApplication("SAP ERP"); leftSide.addEntitlement("SAP_AP_PROCESSOR"); leftSide.addEntitlement("SAP_AP_APPROVER"); leftSide.addEntitlement("SAP_AP_ADMIN"); constraint.setLeftConstraint(leftSide); // Right side: Accounts Receivable entitlements PolicyConstraint rightSide = new PolicyConstraint(); rightSide.setApplication("SAP ERP"); rightSide.addEntitlement("SAP_AR_PROCESSOR"); rightSide.addEntitlement("SAP_AR_APPROVER"); rightSide.addEntitlement("SAP_AR_ADMIN"); constraint.setRightConstraint(rightSide); // Set violation severity and remediation constraint.setViolationSeverity("High"); constraint.setCompensatingControl("Dual approval required for transactions > $10,000"); sodPolicy.addConstraint(constraint); context.saveObject(sodPolicy); context.commitTransaction(); ``` ### Step 4: Configure Revocation and Remediation Workflows Automate access removal when certifiers revoke entitlements: ```java // Configure automatic provisioning for revoked entitlements import sailpoint.object.*; import sailpoint.api.*; // Create remediation workflow Workflow remediationWorkflow = new Workflow(); remediationWorkflow.setName("Certification Revocation Workflow"); remediationWorkflow.setType(Workflow.Type.CertificationRemediation); // Step 1: Create provisioning plan for revocation Step createPlan = new Step(); createPlan.setName("Create Revocation Plan"); createPlan.setScript( "import sailpoint.object.ProvisioningPlan;\n" + "import sailpoint.object.ProvisioningPlan.AccountRequest;\n" + "import sailpoint.object.ProvisioningPlan.AttributeRequest;\n\n" + "ProvisioningPlan plan = new ProvisioningPlan();\n" + "plan.setIdentity(identity);\n" + "AccountRequest acctReq = new AccountRequest();\n" + "acctReq.setApplication(applicationName);\n" + "acctReq.setOperation(AccountRequest.Operation.Modify);\n" + "AttributeRequest attrReq = new AttributeRequest();\n" + "attrReq.setName(entitlementAttribute);\n" + "attrReq.setValue(entitlementValue);\n" + "attrReq.setOperation(ProvisioningPlan.Operation.Remove);\n" + "acctReq.add(attrReq);\n" + "plan.add(acctReq);\n" + "return plan;" ); // Step 2: Execute provisioning with retry logic Step executeProvisioning = new Step(); executeProvisioning.setName("Execute Revocation"); executeProvisioning.setScript( "import sailpoint.api.Provisioner;\n" + "Provisioner provisioner = new Provisioner(context);\n" + "provisioner.setNoTriggers(false);\n" + "ProvisioningResult result = provisioner.execute(plan);\n" + "if (result.isCommitted()) {\n" + " auditEvent(\"Entitlement revoked successfully\", identity, plan);\n" + "} else {\n" + " openWorkItem(\"Manual revocation required\", identity, plan);\n" + "}" ); // Step 3: Send notification to user and manager Step notification = new Step(); notification.setName("Send Revocation Notification"); notification.setScript( "import sailpoint.tools.EmailTemplate;\n" + "EmailTemplate template = context.getObjectByName(\n" + " EmailTemplate.class, \"Access Revocation Notification\");\n" + "Map args = new HashMap();\n" + "args.put(\"identityName\", identity.getDisplayName());\n" + "args.put(\"applicationName\", applicationName);\n" + "args.put(\"entitlementName\", entitlementValue);\n" + "args.put(\"certifierName\", certifier.getDisplayName());\n" + "args.put(\"revocationReason\", decisionReason);\n" + "context.sendEmailNotification(template, args);" ); context.saveObject(remediationWorkflow); context.commitTransaction(); ``` ### Step 5: Monitor Campaign Progress and Compliance Metrics Track certification completion and generate compliance evidence: ```java // Campaign monitoring and reporting script import sailpoint.object.*; import sailpoint.api.*; import java.util.*; // Get all active certification campaigns QueryOptions qo = new QueryOptions(); qo.addFilter(Filter.eq("phase", Certification.Phase.Active)); Iterator certIterator = context.search(Certification.class, qo); while (certIterator.hasNext()) { Certification cert = certIterator.next(); System.out.println("Campaign: " + cert.getName()); System.out.println(" Type: " + cert.getType()); System.out.println(" Phase: " + cert.getPhase()); System.out.println(" Due Date: " + cert.getExpiration()); // Get completion statistics CertificationStats stats = cert.getStatistics(); int totalItems = stats.getTotalEntities(); int completedItems = stats.getCompletedEntities(); int pendingItems = totalItems - completedItems; double completionPct = (completedItems * 100.0) / totalItems; System.out.println(" Total Items: " + totalItems); System.out.println(" Completed: " + completedItems + " (" + String.format("%.1f", completionPct) + "%)"); System.out.println(" Pending: " + pendingItems); // Decision breakdown int approved = stats.getApprovedCount(); int revoked = stats.getRevokedCount(); int mitigated = stats.getMitigatedCount(); int delegated = stats.getDelegatedCount(); System.out.println(" Decisions:"); System.out.println(" Approved: " + approved); System.out.println(" Revoked: " + revoked); System.out.println(" Mitigated: " + mitigated); System.out.println(" Delegated: " + delegated); // Identify overdue certifiers List certifiers = cert.getCertifiers(); for (Object certObj : certifiers) { CertificationEntity entity = (CertificationEntity) certObj; if (!entity.isCompleted() && cert.isOverdue()) { System.out.println(" [OVERDUE] Certifier: " + entity.getCertifier().getDisplayName()); } } System.out.println(); } ``` ### Step 6: Generate Audit Evidence and Reports Export certification results for auditor review: ```java // Generate audit report for completed certifications import sailpoint.object.*; import sailpoint.api.*; import sailpoint.tools.Util; // Query completed certifications for the audit period QueryOptions qo = new QueryOptions(); qo.addFilter(Filter.eq("phase", Certification.Phase.End)); qo.addFilter(Filter.ge("signed", Util.stringToDate("2026-01-01"))); qo.addFilter(Filter.le("signed", Util.stringToDate("2026-03-31"))); List results = context.getObjects(Certification.class, qo); StringBuilder auditReport = new StringBuilder(); auditReport.append("ACCESS CERTIFICATION AUDIT REPORT\n"); auditReport.append("Period: Q1 2026\n"); auditReport.append("Generated: " + new Date() + "\n"); auditReport.append("=".repeat(50) + "\n\n"); int totalCampaigns = 0; int totalDecisions = 0; int totalRevocations = 0; for (Certification cert : results) { totalCampaigns++; CertificationStats stats = cert.getStatistics(); auditReport.append("Campaign: " + cert.getName() + "\n"); auditReport.append(" Certifier: " + cert.getCertifiers().size() + " reviewers\n"); auditReport.append(" Items Reviewed: " + stats.getTotalEntities() + "\n"); auditReport.append(" Approved: " + stats.getApprovedCount() + "\n"); auditReport.append(" Revoked: " + stats.getRevokedCount() + "\n"); auditReport.append(" Completed: " + cert.getSigned() + "\n"); auditReport.append(" Sign-off: " + (cert.isSignedOff() ? "YES" : "NO") + "\n\n"); totalDecisions += stats.getTotalEntities(); totalRevocations += stats.getRevokedCount(); } auditReport.append("SUMMARY\n"); auditReport.append("Total Campaigns: " + totalCampaigns + "\n"); auditReport.append("Total Decisions: " + totalDecisions + "\n"); auditReport.append("Total Revocations: " + totalRevocations + "\n"); auditReport.append("Revocation Rate: " + String.format("%.1f%%", (totalRevocations * 100.0) / totalDecisions)); System.out.println(auditReport.toString()); ``` ## Key Concepts | Term | Definition | |------|------------| | **Certification Campaign** | An organized review process where designated certifiers validate whether users should retain their current access entitlements across one or more applications | | **Access Review** | Individual review unit within a campaign where a certifier examines and makes approve/revoke decisions on specific user entitlements | | **Entitlement** | A specific permission, group membership, role, or access right granted to an identity on a target application | | **Certifier** | The reviewer responsible for making access decisions, typically a manager, application owner, or data owner | | **Revocation** | Decision to remove an entitlement from a user, triggering a provisioning request to the target application for access removal | | **SOD Violation** | Separation of Duties conflict where a user holds entitlements from two or more conflicting access groups that create a segregation risk | | **Remediation** | Automated or manual process of removing revoked access from target systems following certification decisions | ## Tools & Systems - **SailPoint IdentityIQ**: Enterprise identity governance platform providing access certifications, lifecycle management, and compliance reporting - **IdentityIQ Compliance Manager**: Module for running certification campaigns, tracking reviewer progress, and generating compliance evidence - **SailPoint REST API**: Programmatic interface for automating certification campaigns, querying status, and extracting audit data - **IdentityIQ Report Builder**: Built-in reporting engine for generating access review statistics, SOD violation summaries, and trend analysis ## Common Scenarios ### Scenario: SOX Compliance Quarterly Access Review **Context**: A publicly traded company must demonstrate quarterly access reviews for all financial applications per SOX Section 404. The previous manual review process took 6 weeks and produced inconsistent results. **Approach**: 1. Define application scope: SAP ERP, Oracle Financials, banking platforms, and treasury systems 2. Configure manager certifications with 30-day active period for general access review 3. Create targeted entitlement certifications for privileged financial roles with application owner as certifier 4. Enable SOD policy checks to flag AP/AR, GL posting/approval, and user admin/transaction conflicts 5. Configure automatic reminders at 7, 14, and 21 days with escalation to compliance team at day 25 6. Set default-revoke for items not reviewed by campaign end to enforce completion accountability 7. Generate signed certification reports with decision audit trail for external auditors 8. Track revocation completion to ensure all denied access is actually removed from target systems **Pitfalls**: - Not pre-populating entitlement descriptions causes certifiers to approve everything they do not understand - Setting campaigns too short (under 21 days) results in rubber-stamping and low-quality reviews - Not validating that revocations are actually provisioned to target systems (approve on paper, still active in system) - Missing service accounts from review scope when they have access to financial systems ## Output Format ``` ACCESS CERTIFICATION CAMPAIGN REPORT ======================================= Campaign: Q1-2026 Manager Access Review Type: Manager Certification Period: 2026-01-15 to 2026-02-14 Status: COMPLETED COVERAGE Identities Reviewed: 2,847 Applications In Scope: 34 Total Entitlements: 18,392 DECISION SUMMARY Approved: 16,841 (91.6%) Revoked: 1,203 (6.5%) Mitigated: 198 (1.1%) Delegated: 150 (0.8%) REVOCATION STATUS Provisioned: 1,089 / 1,203 (90.5%) Pending: 87 Failed: 27 (manual work items created) SOD VIOLATIONS Flagged: 43 Remediated: 31 Compensating Controls: 12 CERTIFIER COMPLIANCE On-Time Completion: 89.3% Required Escalation: 14 certifiers Average Review Time: 3.2 minutes per item SIGN-OFF Campaign Signed: 2026-02-14 by compliance-admin Audit Evidence: Exported to /reports/Q1-2026-cert-evidence.pdf ``` --- Source attribution: xalgord Original project: https://github.com/xalgord/xalgorix/blob/cec44d71b1d998208e1e2091982d0ee2f928041f/internal/tools/skills/data/identity-access-management/performing-entitlement-review-with-sailpoint-iiq/SKILL.md License: Apache-2.0 License information: https://www.apache.org/licenses/LICENSE-2.0 Original upstream instructions; downloaded from Dave AI. ## Upstream license notice Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution." "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed. 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and (b) You must cause any modified files to carry prominent notices stating that You changed the files; and (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. 5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions. 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file. 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License. 8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages. 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. END OF TERMS AND CONDITIONS APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives. Copyright 2026 xalgord Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. # Dave AI resource metadata Creator / publisher: xalgord Original project: https://github.com/xalgord/xalgorix/blob/cec44d71b1d998208e1e2091982d0ee2f928041f/internal/tools/skills/data/identity-access-management/performing-entitlement-review-with-sailpoint-iiq/SKILL.md Attribution basis: Source repository record Fields of work: Data & Analytics, Development & Engineering, Legal, Operations Roles: Business Process Analyst, Compliance Officer, Data Analyst, IT Operations, Security Engineer Specialties: Specialty not specified Tools: Sailpoint Country applicability: Country not specified Classification basis: Source catalog labels Instruction SHA-256: 491d541dff37ce49d6450e1869782e8463be7cec85ac7777de5d9d7786c859b5