Platform category · 2 min read
Entitlement management
Short answer
Entitlement management covers two related product types: governance tools that inventory, request, approve and review entitlements across applications, and runtime authorization engines that evaluate policies when a request happens; together they answer both who should have access and whether this request is allowed.
Key takeaways
- Governance decides who should hold which entitlements; runtime engines decide each request.
- Coarse entitlements can be provisioned into apps; fine-grained rules belong in policy.
- Externalized authorization makes policies reviewable and changeable without code releases.
An entitlement is a single permission: a role in the ERP, a group in the directory, the right to approve payments up to a limit. Organizations have hundreds of thousands of them. Entitlement management is how you keep that mass understandable and correct.
What are the two halves?
Governance (who should have what) and enforcement (is this request allowed).
| Governance (IGA, EM) | Runtime authorization | |
|---|---|---|
| Question | Should Alex hold "invoice-approver"? | May Alex approve invoice 993 now? |
| When | On request, on schedule | On every request |
| Inputs | HR data, roles, approvals, reviews | Subject, resource, action, context attributes |
| Outputs | Grants provisioned, review records | Permit or deny, obligations |
| Standards | SCIM for provisioning | XACML, policy languages |
See identity management systems for the governance side and Axiomatics Policy Server for an example of the runtime side.
How does federation relate?
Federation carries identity and coarse attributes at sign-in; entitlements are better managed separately.
The article on federation and entitlement management explains the split and where each kind of permission should live.
What should I look for?
Connectors to your applications, a clear entitlement model, usable reviews, and policy tooling that fits your developers.
- Can it discover entitlements in your key applications?
- Can business owners understand entitlement names, or does it need a catalog with descriptions?
- Are reviews small, contextual and automatically enforced?
- For runtime engines: latency, caching, policy language, testing tools and audit of decisions.
- Can policies and configuration be managed as code?
Questions
What is externalized authorization management?
Moving authorization logic out of application code into a policy decision point, so applications ask 'is this allowed?' and enforce the answer. XACML products and newer policy engines both follow this model.
What is CIEM?
Cloud infrastructure entitlement management, a specialized category for analyzing and right-sizing permissions in cloud platforms.