Policy checks when you add access directly
When you give someone access yourself, Owlie checks it against your deny rules and separation-of-duties rules before it changes anything in the connected system. It's the same check an access request gets. A blocking policy stops the add. A policy that only warns lets you add the access anyway, and Owlie records a policy exception so the deny doesn't remove that access later.
Owlie checks these direct adds:
- A new account. On the identity's Resources tab, select Provision and choose a resource.
- Baseline Grants. Provisioning also adds the resource's baseline Grants, so the check covers them even when you pick no Grants yourself.
- Grants you add or set. On the identity's Resources tab, select the assigned resource, then Send action > Add Grants or Set Grants.
- The access a Grant needs first. Some Grants bring other access with them, such as the organization membership an Auth0 organization role needs. A deny on that access covers the Grant too.
A Grant the account already has isn't checked again while it still has a current reason to be there. Owlie checks it like a new Grant when its time limit has passed, or when the account has it only because another Grant needs it. Adding it then gives it a new reason, so it's new access.
Read the policy check
The dialog checks your choices as you make them and shows the result under Policy check, above the dialog's buttons. When no policy applies, the section doesn't appear.
| Result | What the dialog shows | What you can do |
|---|---|---|
| Blocked | "Policy blocks Grant". When the deny covers access the Grant needs first, the line adds "via" and names that access. The send button is disabled. | Remove the blocked Grants, or request the access instead. |
| Warning | "Policy warns about Grant". The send button changes to Add anyway, or Provision anyway for a new account. | Confirm the warning by selecting Add anyway. |
| Can't be checked yet | "Policy can't be checked yet for Grant". The send button is disabled. | Try again after the integration syncs. Owlie needs current data from the connected system to evaluate the policy. |
You can't confirm past a blocking policy in the dialog. To give the access anyway, create an access request for the person. A request that a blocking policy covers waits for a policy exception approval under Governance > Exceptions, on the Approvals tab.
A rule from a separation-of-duties pair shows "(separation of duties)" after its name. For example, if a deny named "No production access for contractors" covers the organization membership an organization role needs, the check reads "No production access for contractors blocks Admin · Organization role, via Membership in Production".
Confirm a policy warning
To confirm a warning, you need the policy.exception.approve permission. The built-in owner and
admin roles include it. Without it, the dialog shows the warning with "Adding it anyway needs someone
with policy exception approval." and the send button stays disabled.
- Read each warning under Policy check. Each line names the policy and the access it warns about.
- Select Add anyway, or Provision anyway for a new account.
Owlie records a policy exception for each warning you confirmed, then queues the change. The exception keeps the deny from removing that access later. Once the access is in place, the exception appears under Governance > Exceptions, on the Exceptions tab, with the source Advisory gate. You can revoke it there. The deny then applies to that access again.
Your confirmation covers the version of each policy the check showed. If someone changes a policy between the check and your confirmation, Owlie stops the add and shows the new result with "Policy stopped this change. Review the check, then try again." Review the updated check and confirm again.
Adds through the API and the AI assistant
The API, the SDK, and the Owlie AI assistant go through the same check, but they can't confirm a
warning. A blocking or a warning deny refuses the add. The GraphQL error's extensions.code is
ACCESS_POLICY_BLOCKED or ACCESS_POLICY_CONFIRMATION_REQUIRED, and extensions.details lists each
item with the policies that cover it. To add access a policy warns about, confirm the warning in the
Owlie dashboard.
Troubleshooting
"Your role can't confirm policy warnings." Your role doesn't have policy.exception.approve.
Ask someone who has it to make the add, or request the access instead.
"Policy can't be confirmed yet for Grant." You confirmed a warning that covers something Owlie hasn't found in the connected system yet, so Owlie can't record an exception for it. The add stops, and the dialog stays open with this line in place of the warning. The note under it names what Owlie hasn't seen. Sync the integration, then confirm again, or remove the Grant.