# Birthright access

**Birthright access** refers to the entitlements that are granted automatically when specified conditions are true. For example, a business rule can be configured so that during the joiner process, a user with a job title of "HR Information Specialist" is automatically assigned the roles specific to that job function. The same rule can be configured to remove those roles if the job title changes during the mover process.

## Adding targets

Targets are actions performed on a user. They are invoked when the conditions defined in a business rule are met.

{% stepper %}
{% step %}

#### Select **Add target**.

{% endstep %}

{% step %}

#### Enter the **Name** and **Description** of the target.

Select **Active** to ensure the target will be applied by the business rules. Select **Save**.
{% endstep %}

{% step %}

#### Right-click the target name from the target list and select **Add action**.

{% endstep %}

{% step %}

#### Select a **Type**:

<table><thead><tr><th width="313">Action type</th><th>Description</th></tr></thead><tbody><tr><td>Activate user</td><td>Activates the user account.</td></tr><tr><td>Add user to group</td><td>Assigns the user to a group. Choose the Managed System and group.</td></tr><tr><td>Add user to organization</td><td>Assigns the user to an organization. Choose the organization type and organization.</td></tr><tr><td>Add user to role</td><td>Assigns the user to a role. Choose the Managed System and role.</td></tr><tr><td>Call Groovy script</td><td>Calls a specified Groovy script when the target is invoked.</td></tr><tr><td>Deactivate user</td><td>Deactivates the user account.</td></tr><tr><td>Disable user</td><td>Disables the user account.</td></tr><tr><td>Enable user</td><td>Enables the user account.</td></tr><tr><td>Grant resource to user</td><td>Grants a resource to the user. Choose the resource type and resource.</td></tr><tr><td>Lock user</td><td>Locks the user account.</td></tr><tr><td>Remove all entitlements (roles, groups, organizations, resources) now</td><td>Removes all entitlements from the user immediately.</td></tr><tr><td>Remove user from group</td><td>Removes the user from a group. Choose the Managed System and group.</td></tr><tr><td>Remove user from organization</td><td>Removes the user from an organization. Choose the organization type and organization.</td></tr><tr><td>Remove user from role</td><td>Removes the user from a role. Choose the Managed System and role.</td></tr><tr><td>Resume access, erase memberships end dates</td><td>Restores access by removing end dates from memberships.</td></tr><tr><td>Resume access, prolong end date for given number of days from current moment</td><td>Restores access and extends it by a specified number of days from the time the target is invoked.</td></tr><tr><td>Revoke access from resource</td><td>Revokes a resource from the user. Choose the resource type and resource.</td></tr><tr><td>Terminate access to all entitlements by setting end date for now</td><td>Ends all entitlements immediately by setting their end date to now.</td></tr></tbody></table>
{% endstep %}

{% step %}

#### Select **Save**.

Multiple actions can be added per target.
{% endstep %}
{% endstepper %}

<figure><img src="/files/IFY6xwFMZljkAZJS61BB" alt=""><figcaption></figcaption></figure>

***

## Adding business rules

Business rules define when targets are invoked by specifying conditions that are evaluated against users.

{% stepper %}
{% step %}

#### Select **Add business rules**.

{% endstep %}

{% step %}

#### Enter the **Name** and **Description** of the new business rule.

{% endstep %}

{% step %}

#### Choose an **Operation**:

<table><thead><tr><th width="185">Operation</th><th>When it applies</th></tr></thead><tbody><tr><td>All</td><td>Applied during both new user creation and user updates.</td></tr><tr><td>Add</td><td>Applied during new user creation only.</td></tr><tr><td>Update</td><td>Applied during user updates only.</td></tr></tbody></table>
{% endstep %}

{% step %}

#### Choose a **Status**: Active or Inactive.

{% endstep %}

{% step %}

#### Choose the required target in the respective section.

In **Apply selected rule when conditions match**, choose the target to invoke when conditions are met.

In **Apply selected rule when conditions DO NOT match**, choose the target to invoke when conditions are not met.

Right-click **Or** to begin building conditions:

<figure><img src="/files/1QP4UjT9vVAytxj7BWGm" alt=""><figcaption></figcaption></figure>

<table><thead><tr><th width="157.6666259765625">Option</th><th>Description</th></tr></thead><tbody><tr><td>Add <code>Or</code></td><td>Groups two or more expressions. The condition evaluates to true if any one expression is true.</td></tr><tr><td>Add <code>And</code></td><td>Groups two or more expressions. The condition evaluates to true only if all expressions are true.</td></tr><tr><td>Add <code>Expression</code></td><td>Adds an expression to evaluate. Set <strong>Negation</strong> to true to reverse the result.</td></tr><tr><td>Add <code>Groovy</code></td><td>Adds a Groovy script whose logic is evaluated against the user.</td></tr><tr><td>Edit</td><td>Edits an existing condition node.</td></tr></tbody></table>
{% endstep %}

{% step %}

#### **Select Save**.

{% endstep %}
{% endstepper %}

{% hint style="info" %}
This matching/non-matching pair is the key mechanism for automatic access transitions. When a user moves to a new job title, the matching target grants the new access and the non-matching target removes the old access — no workflow or custom preprocessing script is required.
{% endhint %}

***

## Out of sync users

Out of sync users are users who will be impacted by updated business rules but have not yet been provisioned.

* Select **Preview impacted users** to evaluate all users against the updated business rules and display the list of affected users.
* Select **Provision impacted users** to begin provisioning out of sync users.

{% hint style="info" %}
If a business rule is newly implemented and you have existing users you want it to apply to, use the **Perform Business Rules recalculation** batch task. See the [scheduled tasks documentation](https://docs.openiam.com/docs-4.2.1.14/developerguide/4-scheduledtasks) for details.
{% endhint %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs-beta.openiam.com/automated-user-provisioning/birthright-access.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.