Skip to main content
Access policies define the rules that govern how users request and receive access to applications and resources. Create reusable policies to maintain consistent access controls across your organization.

​
Understanding Access Policies

When creating or editing an access policy, configure the following settings to manage duration, and approvals needed for roles.

Policy Name

Descriptive name that indicates when the policy should be used (e.g., “High Security”, “Standard Access”)

Policy Description

Detailed explanation of what the policy covers and when to apply it

Max Access Length

Maximum duration users can keep access before automatic revocation (options: indefinite, hours, days, weeks, months)

Recommended Access Length

Suggested duration to guide users toward shorter access periods while still allowing maximum if needed

Require Business Justification

Toggle on to require users to explain why they need access; Serval evaluates reasonableness based on guidance settings

Require Confirmation for Requests Made on Behalf of Others

Toggle on to add verification step when someone requests access for another user

Require Approval

Select specific users, groups, or special members (like user’s manager) who must approve requests

Allow Self-Approval

Toggle whether approvers can approve their own access requests

Multiple Approval Steps

Add sequential approval requirements where each step must be completed before the next begins

Impact Preview

View how many applications and roles will be affected by policy changes before saving
If you add multiple approvers in a single step, any one of them can approve the request. For sequential approvals, add multiple approval steps.
Screenshot2025 11 21at11 03 09PM Pn

Edit access policy

​
Create an Access Policy

1

Click Create Policy

Click “Create policy” or select an existing access policy to modify
2

Name the policy

Enter a policy name and description. Use descriptive names like “General Access” or “Temporary Admin Access” that indicate when the policy should be used.
3

Set access duration

Choose indefinite or time-limited access for Max Access Length. Optionally set a Recommended Access Length to guide users toward shorter access periods while still allowing them to request the maximum if needed.
Use time-limited access for elevated permissions like admin roles. Use indefinite access for standard user roles.
4

Configure justification and confirmation

Toggle on “Require business justification” to require users to explain why they need access. Serval will evaluate whether the justification is reasonable based on your guidance settings.Toggle on “Require confirmation for requests made on behalf of others” to add verification when someone requests access for another user.
5

Set up approvals

Add approval steps by selecting approvers. You can require approval from specific users, groups, or special members like the user’s manager.For each approval step, configure:
  • Who can approve (individual users or groups)
  • Whether approvers can self-approve their own requests
  • Whether any one approver can approve, or if all must approve
Add multiple approval steps for sensitive access by clicking “Add approval step”. Approvals happen sequentially—the second step only begins after the first is complete.
If you add multiple approvers in a single step, any one of them can approve the request. For sequential approvals, add multiple approval steps.
6

Preview impact

Check how many roles will be affected by this policy before saving.
7

Save the policy

Click “Save policy” to make it available for role configuration. You’ll see which applications will be affected by the new policy.

​
Manage Access Policies

Once created, access policies can be managed centrally and applied to multiple roles across your organization. To access policy management, navigate to the relevant team, click the ”…” button, and select “Access Policies.”
Choose a default policy that applies to new roles automatically to ensure consistent baseline access controls.
Modify policy settings. Changes apply to all roles using that policy, making it easy to update access controls organization-wide.
See which roles currently use each policy to understand the impact before making changes.
Add or remove roles that the policy should apply to. Reuse policies across similar access patterns for consistency.
Set up new standard policies for your organization to be used across any number of roles.
251120-docs-access-manage policies.gif

Manage access policies

​
Best Practices

Start strict, relax as needed

Begin with tighter controls and loosen them based on feedback. It’s easier to remove friction than add security later.

Use time limits for elevated access

Temporary access to admin or sensitive roles reduces security risk and ensures cleanup happens automatically.

Group similar roles under one policy

Create policies for access patterns, not individual roles. This makes management easier as you scale.

Review policies regularly

Audit which policies are in use and whether they still match your security requirements.