Self-provisioning

Once eligible, a user can turn access to an entitlement on without an approver. The user keeps this right for a set window, and each activation expires on its own.

How it works

Self-provisioning has two durations:

The Authorization Window is how long the user keeps the right to self-provision. Trustle calls this right an eligibility.
The per-activation grant is how long one activation lasts. The entitlement’s Maximum Request Duration sets it.

A user gets an eligibility in one of these ways:

An approver approves the user’s request and selects Authorize self-provisioning for this user. This checkbox is clear by default. An approval without it grants the access one time only.
An admin grants the entitlement to the user directly. On an entitlement with self-provisioning on, a direct grant creates an eligibility. It does not provision access. The user activates it later.
An admin converts the user’s standing access. See Convert standing access to self-provisioning.

While the eligibility is live, the user activates the entitlement from My Access. Trustle approves the activation without an approver and provisions the access. After the eligibility expires, the next request goes through the full approval workflow again.

Self-provisioning works with the Manager, Single Approval, Quorum Approval, and Two-Level Approval routings. Department-Based Routing does not support it.

Self-provisioned access differs from standing access. Standing access has no expiration. Each self-provisioned activation expires, and the user activates again when they need the access.

Before you start

You need the Trustle admin role.
The entitlement must use a routing that supports self-provisioning.

Configure self-provisioning

You can turn on self-provisioning at three levels. A lower level overrides the level above it:

The organization default, on the Policies page, if your organization has it enabled.
A connection, on the connection’s Approval Policies tab.
An entitlement, on the entitlement’s Approval Policies tab.

The steps below configure one entitlement.

Step 1: Open the entitlement’s approval policy

In the sidebar, under Govern, click Connections.
Open the connection, then open the entitlement.
Click the Approval Policies tab.
If the entitlement uses its connection’s policy, click Customize Policy.

Step 2: Turn on Self-Provisioning

Turn on the Self-Provisioning switch. Its help text reads Automatically grant access after the first manual approval?.

Step 3: Set the Authorization Window

Set the Authorization Window, for example 90 days. The summary above the field shows the per-activation grant and the window.

Step 4: Set the Maximum Request Duration

Set Maximum Request Duration to the length of one activation, for example 1 Day. The Authorization Window must be longer than this value.

Step 5: Save the policy

Click Save Changes.

Convert standing access to self-provisioning

An admin can convert a user’s existing access to self-provisioning. The user does not need to request it again.

Find the user’s access row. Use the user’s page under People, or the entitlement’s Members tab.
Open the row’s actions menu and click Convert to Self-Provisioning.
If the entitlement has no self-provisioning policy, Trustle shows Self-provisioning is not enabled for this entitlement. Click Configure Policy to set one up first.
Check the Authorization window and the Per-activation grant, then click Convert.

Trustle caps the user’s current access at the per-activation grant. The user can activate again at any time during the window without admin approval.

Duration limits

A per-activation grant cannot exceed 365 days.
An Authorization Window cannot exceed 730 days.
The per-activation grant must be shorter than the Authorization Window.

What users see

On My Access, the Eligible To Activate section lists each live eligibility and the time left on it. To turn on access:

Click Activate on the entitlement.
Select a Duration. The dialog shows the Max Session for one activation.
Enter a reason. The reason is required.
Click Activate.

Active self-provisioned access appears in the Self-Provisioned section. Each row shows the entitlement, the reason, and the time left. Each row has two buttons:

Extend asks for more time on the current activation, up to the per-activation limit.
End Now removes the access at once. The user can activate it again while the eligibility is live.

Extend an eligibility

When an eligibility has less than 7 days left, its card shows Request Extension. The user selects an Extension Duration, enters a Reason, and clicks Submit Request.

An eligibility extension is an ordinary access request:

It goes to the same approvers as a new request for the entitlement.
It never approves itself.
It adds the approved time to the current end of the window. It does not restart the window.
One extension cannot ask for more than the Authorization Window.