# LCS logic errors

**URL:** <https://developer.sailpoint.com/discuss/t/lcs-logic-errors/210677>\
**Category:** SHF Discussion and Questions\
**Tags:** sailpoint-identity-security\
**Created:** [May 27, 2026, 6:46pm UTC](https://developer.sailpoint.com/discuss/t/lcs-logic-errors/210677 "2026-05-27T18:46:45Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![pillar224](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/pillar224/32/29956_2.png) [@pillar224](https://developer.sailpoint.com/discuss/u/pillar224)\
**Post date:** [May 27, 2026, 6:46pm UTC](https://developer.sailpoint.com/discuss/t/lcs-logic-errors/210677/1 "2026-05-27T18:46:45Z")

</div>

There’s a flaw in my LCS logic somewhere but I can’t find where. I have a transform determining what LCS Identities go into, but for some reason it’s dumping 27 active Identities (they are active in our HR system I mean) in the terminated LCS. Can someone help? This transform was initially written by SailPoint Advisory Services but I’ve made some changes here and there.

 ![image](https://global.discourse-cdn.com/sailpoint/original/3X/8/8/880b027d911400a167768d60252d74476e02e5bc.png)

```auto
{
    "id": "e4a012e2-32f7-4659-8162-446a9118f5f8",
    "name": " - LifeCycleState",
    "type": "static",
    "attributes": {
        "disableAD": {
            "type": "upper",
            "attributes": {
                "input": {
                    "type": "firstValid",
                    "attributes": {
                        "values": [
                            {
                                "type": "accountAttribute",
                                "attributes": {
                                    "attributeName": "companyUDF.DISABLE AD",
                                    "sourceName": "UKG Pro (HR)"
                                }
                            },
                            {
                                "type": "static",
                                "attributes": {
                                    "value": "NONE"
                                }
                            }
                        ]
                    }
                }
            }
        },
        "employeeStatus": {
            "type": "accountAttribute",
            "attributes": {
                "attributeName": "employeeStatus",
                "sourceName": "UKG Pro (HR)"
            }
        },
        "hireDate": {
            "type": "dateFormat",
            "attributes": {
                "inputFormat": "M/d/yyyy hh:mm:ss a",
                "outputFormat": "yyyy-MM-dd",
                "input": {
                    "type": "firstValid",
                    "attributes": {
                        "values": [
                            {
                                "type": "accountAttribute",
                                "attributes": {
                                    "attributeName": "hireDate",
                                    "sourceName": "UKG Pro (HR)"
                                }
                            },
                            {
                                "type": "static",
                                "attributes": {
                                    "value": "1/1/1900 12:00:00 AM"
                                }
                            }
                        ]
                    }
                }
            }
        },
        "termReason": {
            "type": "firstValid",
            "attributes": {
                "values": [
                    {
                        "type": "accountAttribute",
                        "attributes": {
                            "attributeName": "employmentDetails.termReason",
                            "sourceName": "UKG Pro (HR)"
                        }
                    },
                    {
                        "type": "static",
                        "attributes": {
                            "value": "NONE"
                        }
                    }
                ]
            }
        },
        "today": {
            "type": "dateMath",
            "attributes": {
                "expression": "now/d",
                "outputFormat": "yyyy-MM-dd"
            }
        },
        "termDatePlus180": {
            "type": "dateMath",
            "attributes": {
                "expression": "+180d/d",
                "outputFormat": "yyyy-MM-dd",
                "input": {
                    "type": "dateFormat",
                    "attributes": {
                        "inputFormat": "M/d/yyyy hh:mm:ss a",
                        "outputFormat": "ISO8601",
                        "input": {
                            "type": "firstValid",
                            "attributes": {
                                "values": [
                                    {
                                        "type": "accountAttribute",
                                        "attributes": {
                                            "attributeName": "terminationDate",
                                            "sourceName": "UKG Pro (HR)"
                                        }
                                    },
                                    {
                                        "type": "static",
                                        "attributes": {
                                            "value": "1/1/2099 12:00:00 AM"
                                        }
                                    }
                                ]
                            }
                        }
                    }
                }
            }
        },
        "value": "#if(($disableAD == 'ACQUISITION' or $disableAD == 'DOGWOOD' or $disableAD == 'SUNSET') and $employeeStatus != 'T')merger#elseif($employeeStatus == 'A' and $hireDate.compareTo($today) > 0)prehire#elseif(($employeeStatus == 'A') or ($employeeStatus == 'T' and ($termReason == '555' or $termReason == 'TRO')))active#elseif($employeeStatus == 'L')leaveOfAbsence#elseif($employeeStatus == 'T' and $today.compareTo($termDatePlus180) >= 0)delete#elseif($employeeStatus == 'T' and ($termReason != '555' or $termReason != 'TRO'))terminated#end"
    },
    "internal": false
}

```

---

<div class="post-metadata">

**Author:** ![j\_place](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/j_place/32/19181_2.png) [@j\_place](https://developer.sailpoint.com/discuss/u/j_place)\
**Post date:** [May 27, 2026, 7:43pm UTC](https://developer.sailpoint.com/discuss/t/lcs-logic-errors/210677/2 "2026-05-27T19:43:22Z")

</div>

Hi @pillar224 the if/else statement may not provide full coverage of all scenarios (I haven’t examined the full logic), so it may be returning null as there is no default else statement. In which case, the terminated value could have been set while testing previous iterations and the latest iteration is not updating it.

---

<div class="post-metadata">

**Author:** ![j\_place](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/j_place/32/19181_2.png) [@j\_place](https://developer.sailpoint.com/discuss/u/j_place)\
**Post date:** [May 27, 2026, 9:07pm UTC](https://developer.sailpoint.com/discuss/t/lcs-logic-errors/210677/3 "2026-05-27T21:07:54Z")

</div>

Actually, just had a look at your Boolean. This (in your last `else`) may not be giving you what you want:

> [@pillar224](#):
>
> `($termReason != '555' or $termReason != 'TRO')`

This will always return true. You need to put the `not` around the `or`, not in the equality statements. Think about ‘555’, which is not equal to ‘TRO’ so the second predicate will return `true` meaning the `or` predicate will return `true`.

Not saying it’s causing your problem, but it’s sub-optimal 😉

---

<div class="post-metadata">

**Author:** ![j\_place](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/j_place/32/19181_2.png) [@j\_place](https://developer.sailpoint.com/discuss/u/j_place)\
**Post date:** [May 27, 2026, 9:17pm UTC](https://developer.sailpoint.com/discuss/t/lcs-logic-errors/210677/4 "2026-05-27T21:17:12Z")

</div>

Re examining the transform, is it possible these users are in ‘T’ employmentStatus but no termReason provided? Ie termReason is “NONE” thus matching your final else statement.

---

<div class="post-metadata">

**Author:** ![pillar224](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/pillar224/32/29956_2.png) [@pillar224](https://developer.sailpoint.com/discuss/u/pillar224)\
**Post date:** [May 27, 2026, 10:04pm UTC](https://developer.sailpoint.com/discuss/t/lcs-logic-errors/210677/5 "2026-05-27T22:04:59Z")

</div>

Hi Jeremy, I appreciate your responses. To answer your last question, your correct, none of the ones that are incorrectly in the terminated LCS have term reasons

---

<div class="post-metadata">

**Author:** ![UjjwalJain](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/ujjwaljain/32/24704_2.png) [@UjjwalJain](https://developer.sailpoint.com/discuss/u/UjjwalJain)\
**Post date:** [May 28, 2026, 6:11am UTC](https://developer.sailpoint.com/discuss/t/lcs-logic-errors/210677/6 "2026-05-28T06:11:15Z")

</div>

Hi @pillar224,

I don’t see any major issue with your transform logic. However, I would recommend setting the `ignoreErrors` flag to `true` for all `firstValid` sub transforms.

Also, in your last condition, it would be better to use **and instead of or** , like this:

($termReason != ‘555’ and $termReason != 'TRO

---

<div class="post-metadata">

**Author:** ![j\_place](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/j_place/32/19181_2.png) [@j\_place](https://developer.sailpoint.com/discuss/u/j_place)\
**Post date:** [May 28, 2026, 7:17am UTC](https://developer.sailpoint.com/discuss/t/lcs-logic-errors/210677/7 "2026-05-28T07:17:52Z")

</div>

And their employeeStatus?

---

<div class="post-metadata">

**Author:** ![j\_place](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/j_place/32/19181_2.png) [@j\_place](https://developer.sailpoint.com/discuss/u/j_place)\
**Post date:** [May 28, 2026, 9:17am UTC](https://developer.sailpoint.com/discuss/t/lcs-logic-errors/210677/8 "2026-05-28T09:17:47Z")

</div>

Hi @UjjwalJain Why would you recommend setting ignoreErrors to true for all firstvalid sub transforms? Particularly during testing.

---

<div class="post-metadata">

**Author:** ![UjjwalJain](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/ujjwaljain/32/24704_2.png) [@UjjwalJain](https://developer.sailpoint.com/discuss/u/UjjwalJain)\
**Post date:** [May 28, 2026, 9:33am UTC](https://developer.sailpoint.com/discuss/t/lcs-logic-errors/210677/9 "2026-05-28T09:33:44Z")

</div>

As per documentation and best practices, this should be set to true to ensure the transform evaluates the next available option if an error occurs in the current block.

---

<div class="post-metadata">

**Author:** ![j\_place](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/j_place/32/19181_2.png) [@j\_place](https://developer.sailpoint.com/discuss/u/j_place)\
**Post date:** [May 28, 2026, 9:44am UTC](https://developer.sailpoint.com/discuss/t/lcs-logic-errors/210677/10 "2026-05-28T09:44:07Z")

</div>

My point is, why would you not want to investigate errors? The documentation gives a specific example where a function ($identity.manager.attributes.networkDn) could generate an NPE and if you want to ignore that NPE then set ignoreErrors. The OP firstValid uses accountAttribute transform. If that is generating an error, you would want to investigate.

---

<div class="post-metadata">

**Author:** ![kannan\_sb85](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/kannan_sb85/32/35971_2.png) [@kannan\_sb85](https://developer.sailpoint.com/discuss/u/kannan_sb85)\
**Post date:** [May 28, 2026, 9:44am UTC](https://developer.sailpoint.com/discuss/t/lcs-logic-errors/210677/11 "2026-05-28T09:44:34Z")

</div>

@pillar224 Hi Derek - Can you check the below corrected logic transform code -

```json
{
    "id": "1cb35554-7cbe-46b6-97ad-3a6582432bf9",
    "name": " Determine LifeCycleState",
    "type": "static",
    "attributes": {
        "disableAD": {
            "type": "upper",
            "attributes": {
                "input": {
                    "type": "firstValid",
                    "attributes": {
                        "ignoreErrors": true,
                        "values": [
                            {
                                "type": "accountAttribute",
                                "attributes": {
                                    "attributeName": "companyUDF.DISABLE AD",
                                    "sourceName": "UKG Pro (HR)"
                                }
                            },
                            {
                                "type": "static",
                                "attributes": {
                                    "value": "NONE"
                                }
                            }
                        ]
                    }
                }
            }
        },
        "employeeStatus": {
            "type": "accountAttribute",
            "attributes": {
                "attributeName": "employeeStatus",
                "sourceName": "UKG Pro (HR)"
            }
        },
        "hireDate": {
            "type": "dateFormat",
            "attributes": {
                "inputFormat": "M/d/yyyy hh:mm:ss a",
                "outputFormat": "yyyy-MM-dd",
                "input": {
                    "type": "firstValid",
                    "attributes": {
                        "ignoreErrors": true,
                        "values": [
                            {
                                "type": "accountAttribute",
                                "attributes": {
                                    "attributeName": "hireDate",
                                    "sourceName": "UKG Pro (HR)"
                                }
                            },
                            {
                                "type": "static",
                                "attributes": {
                                    "value": "1/1/1900 12:00:00 AM"
                                }
                            }
                        ]
                    }
                }
            }
        },
        "termReason": {
            "type": "firstValid",
            "attributes": {
                "ignoreErrors": true,
                "values": [
                    {
                        "type": "accountAttribute",
                        "attributes": {
                            "attributeName": "employmentDetails.termReason",
                            "sourceName": "UKG Pro (HR)"
                        }
                    },
                    {
                        "type": "static",
                        "attributes": {
                            "value": "NONE"
                        }
                    }
                ]
            }
        },
        "today": {
            "type": "dateMath",
            "attributes": {
                "expression": "now/d",
                "outputFormat": "yyyy-MM-dd"
            }
        },
        "termDatePlus180": {
            "type": "dateMath",
            "attributes": {
                "expression": "+180d/d",
                "outputFormat": "yyyy-MM-dd",
                "input": {
                    "type": "dateFormat",
                    "attributes": {
                        "inputFormat": "M/d/yyyy hh:mm:ss a",
                        "outputFormat": "ISO8601",
                        "input": {
                            "type": "firstValid",
                            "attributes": {
                                "ignoreErrors": true,
                                "values": [
                                    {
                                        "type": "accountAttribute",
                                        "attributes": {
                                            "attributeName": "terminationDate",
                                            "sourceName": "UKG Pro (HR)"
                                        }
                                    },
                                    {
                                        "type": "static",
                                        "attributes": {
                                            "value": "1/1/2099 12:00:00 AM"
                                        }
                                    }
                                ]
                            }
                        }
                    }
                }
            }
        },
        "value": "#if(($disableAD == 'ACQUISITION' or $disableAD == 'DOGWOOD' or $disableAD == 'SUNSET') and $employeeStatus != 'T')merger#elseif($employeeStatus == 'A' and $hireDate.compareTo($today) > 0)prehire#elseif(($employeeStatus == 'A') or ($employeeStatus == 'T' and ($termReason == '555' or $termReason == 'TRO')))active#elseif($employeeStatus == 'L')leaveOfAbsence#elseif($employeeStatus == 'T' and $today.compareTo($termDatePlus180) >= 0)delete#elseif($employeeStatus == 'T' and ($termReason != '555' and $termReason != 'TRO'))terminated#else active#end"
    },
    "internal": false
}

```

Regards,

Kannan

---

<div class="post-metadata">

**Author:** ![j\_place](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/j_place/32/19181_2.png) [@j\_place](https://developer.sailpoint.com/discuss/u/j_place)\
**Post date:** [May 28, 2026, 9:48am UTC](https://developer.sailpoint.com/discuss/t/lcs-logic-errors/210677/12 "2026-05-28T09:48:49Z")

</div>

@kannan_sb85 @UjjwalJain - The transform is not generating an error - why are you so quick to jump on ignoreErrors?

---

<div class="post-metadata">

**Author:** ![UjjwalJain](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/ujjwaljain/32/24704_2.png) [@UjjwalJain](https://developer.sailpoint.com/discuss/u/UjjwalJain)\
**Post date:** [May 28, 2026, 9:58am UTC](https://developer.sailpoint.com/discuss/t/lcs-logic-errors/210677/13 "2026-05-28T09:58:41Z")

</div>

Hi @j_place,

I didn’t say that `ignoreError` is the issue, I only suggested using it. Please reread my message carefully.

---

<div class="post-metadata">

**Author:** ![UjjwalJain](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/ujjwaljain/32/24704_2.png) [@UjjwalJain](https://developer.sailpoint.com/discuss/u/UjjwalJain)\
**Post date:** [May 28, 2026, 9:59am UTC](https://developer.sailpoint.com/discuss/t/lcs-logic-errors/210677/14 "2026-05-28T09:59:09Z")

</div>

That condition remains as it is.

---

<div class="post-metadata">

**Author:** ![kannan\_sb85](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/kannan_sb85/32/35971_2.png) [@kannan\_sb85](https://developer.sailpoint.com/discuss/u/kannan_sb85)\
**Post date:** [May 28, 2026, 10:02am UTC](https://developer.sailpoint.com/discuss/t/lcs-logic-errors/210677/15 "2026-05-28T10:02:14Z")

</div>

Hi @j_place Jeremy - that is a completely valid point, and worth clarifying.  
You are correct. The transform is not throwing errors it is producing wrong logical output due to the or vs and boolean bug. So Recommending ignoreErrors: true in that context was a reflex toward a best practice checklist rather than a diagnosis of the actual problem. To be precise about what ignoreErrors actually does: it tells the firstValid transform to suppress exceptions thrown by a sub-transform (e.g. a source lookup that fails mid-execution) and move on to the next value in the list. That is entirely separate from the issue here, where the sub-transforms are resolving fine they are just feeding correct values into broken conditional logic.

Regards,

Kannan

---

<div class="post-metadata">

**Author:** ![j\_place](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/j_place/32/19181_2.png) [@j\_place](https://developer.sailpoint.com/discuss/u/j_place)\
**Post date:** [May 28, 2026, 10:25am UTC](https://developer.sailpoint.com/discuss/t/lcs-logic-errors/210677/16 "2026-05-28T10:25:17Z")

</div>

You actually described it as “best practice”. That is what we disagree on.

---

<div class="post-metadata">

**Author:** ![SatishAtike](https://avatars.discourse-cdn.com/v4/letter/s/ebca7d/32.png) [@SatishAtike](https://developer.sailpoint.com/discuss/u/SatishAtike)\
**Post date:** [May 28, 2026, 10:50am UTC](https://developer.sailpoint.com/discuss/t/lcs-logic-errors/210677/17 "2026-05-28T10:50:11Z")

</div>

($employeeStatus == ‘T’ and ($termReason == ‘555’ or $termReason == ‘TRO’)))active

For active users, do you have employeeStatus=='T", could you please check it and confirm?

---

<div class="post-metadata">

**Author:** ![pillar224](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/pillar224/32/29956_2.png) [@pillar224](https://developer.sailpoint.com/discuss/u/pillar224)\
**Post date:** [May 28, 2026, 1:49pm UTC](https://developer.sailpoint.com/discuss/t/lcs-logic-errors/210677/18 "2026-05-28T13:49:43Z")

</div>

Hi Jeremy, thanks again for your response. The employeeStatuses of those 27 are A

---

<div class="post-metadata">

**Author:** ![pillar224](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/pillar224/32/29956_2.png) [@pillar224](https://developer.sailpoint.com/discuss/u/pillar224)\
**Post date:** [May 28, 2026, 2:00pm UTC](https://developer.sailpoint.com/discuss/t/lcs-logic-errors/210677/19 "2026-05-28T14:00:51Z")

</div>

Hi Satish,

Active users have an employeeStatus of ‘A.’ The vast majority of employees with ‘A’ employeeStatus are correctly being put in the Active LCS, it’s just those 27.

> [@pillar224](#):
>
> `#elseif(($employeeStatus == 'A') or ($employeeStatus == 'T' and ($termReason == '555' or $termReason == 'TRO')))active`

---

<div class="post-metadata">

**Author:** ![j\_place](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/j_place/32/19181_2.png) [@j\_place](https://developer.sailpoint.com/discuss/u/j_place)\
**Post date:** [May 28, 2026, 2:03pm UTC](https://developer.sailpoint.com/discuss/t/lcs-logic-errors/210677/20 "2026-05-28T14:03:14Z")

</div>

Hi Derek. Do you have Visual Stdio Code with ISC plugin? If not, I highly recommend to to test Identity attribute transforms such as LCS.

[Next page](https://developer.sailpoint.com/discuss/t/lcs-logic-errors/210677.md?page=2)