I need suggestion on RBAC structure for one of my application in SailPoint IIQ where One role is subset of another role

IdentityIQ (IIQ) IIQ Discussion and Questions
1

Hi All,

I hope everyone is doing well. We need your guidance on designing an RBAC (Role-Based Access Control) structure for our application. In our current design, one role is a subset of another role, meaning that higher-level roles automatically include the permissions of lower-level roles. The detailed role structure has been attached for reference.

Management has a specific expectation: when an end user requests access to the top-level role, they should only be assigned that role. This way, during the Access Review (Certification) process, only the top-level role should appear for the certifier to review. However, since the top-level role inherently includes permissions from all its subset roles (a total of 7 roles), the system currently detects and displays all 7 roles in the certification process.

Here are my questions:

  1. Is there a way to configure SailPoint IdentityIQ (IIQ) so that only the assigned top-level role is visible to the certifier during Access Review, instead of showing all 7 roles?

  2. If all 7 roles continue to appear during certification, will this create any challenges or confusion for the certifier?

We are looking for suggestions on how to streamline this process to ensure the certification view is clean and intuitive for the certifier. Please let us know your thoughts or best practices for handling this situation.

Regards,

Venu

RBAC_BlackLineTR Matrix 1.xlsx (10.7 KB)

2

you can create business role and asigned it role in it and then do the certification for business role.

3

You can create a Business Role that represents a collection of access requirements for a specific business function.

For example, consider an IDAM Business Role. Users in the IDAM team may require access to 10 different applications or entitlements. Instead of presenting all individual entitlements during certification, you can group them under a single Business Role.

There are two common approaches:

*One-to-one mapping: Map each entitlement to a separate IT Role.
One-to-many mapping: Map multiple entitlements to a single IT Role, depending on your role model and business requirements.

Once the Business Role is configured, certifications can be run at the Business Role level. During the access review, the manager will see only the IDAM Business Role.