Skip to main content
An entitlement is a record that tracks the full lifecycle of an access grant for a user to an application or user group. Ravenna creates an entitlement when an access request is approved, then tracks it through provisioning, active use, expiration, revocation, or failure. Entitlements give you a complete picture of access state, not just what is currently active, but also what failed, was revoked, or expired.

​
Entitlement lifecycle

Each entitlement has a status that reflects where it is in the provisioning lifecycle.

​
Viewing entitlements

Navigate to Settings > Applications > Entitlements tab to see entitlements across your applications.By default, the tab shows only Active entitlements. To see other states, such as pending, failed, or inactive entitlements, add a Status filter. Once you pick a status, Ravenna shows exactly the statuses you selected.
Entitlements waiting on manual provisioning are Pending or Processing, so they’re hidden by default. Filter by those statuses to find access that still needs a provisioner.
Use the filters to narrow results by application, access level, status, user, or workspace. Each row shows the user, application, access level, status, created date, time left, and expiration.

​
Ravenna-managed and externally managed entitlements

The tab lists two kinds of entitlements together:
  • Ravenna-managed: access granted through a Ravenna access request. Ravenna tracks these through the full lifecycle.
  • Externally managed: access a user holds through membership in an identity provider group linked to an application, without a matching Ravenna-managed entitlement. For example, a user an admin added to the group directly in Okta.
Externally managed entitlements are always Active and have no access level. They drop out of the list when you filter by access level or by a status other than Active.You can’t revoke, extend, or bulk-select externally managed entitlements. Remove that access in the identity provider instead.The Time Left column shows a live countdown for active time-bound entitlements, formatted as 2d 5h left, 3h 20m left, 45m left, or 30s left as the deadline approaches. Active entitlements with no expiration show Never expires. Entitlements that are not active (pending, deprovisioning, inactive, or failed) show —.

​
Extending entitlements

When access has a duration set by the access policy, you can extend it before or after expiration. Extension creates a new entitlement record linked to the original for lineage tracking. The extended entitlement inherits the same application and access level.
The duration set by the policy starts when the entitlement is provisioned, not when the request is submitted or approved. If a policy grants 7 days of access and approval takes a day, the user still gets a full 7 days from the moment access is granted.

​
Revoking entitlements

Revoke access by selecting an active entitlement and choosing Revoke. You can add an optional revoke note for the audit trail. Only Ravenna-managed entitlements can be revoked.
  • Synced applications: triggers deprovisioning via the IdP integration, removing the user from the group or application.
  • Manual applications: marks the entitlement as deprovisioned. A human must remove the actual access in the target system.
Revoking an entitlement for a synced application immediately removes the user’s access in the identity provider.

​
Manual provisioning

For applications with a manual provisioning method, entitlements require a human to grant access. Authorized provisioners (application owner, ticket assignee, workspace admins, and org admins) can mark entitlements as provisioned.Manual provisioning prompts appear in two places:
  • On the access request ticket, where any authorized provisioner can mark the entitlement as provisioned.
  • In Slack, as a direct message to the ticket assignee. When a manual entitlement moves to Processing, Ravenna DMs the assignee an “Access ready to provision” message with a Provision access button. Clicking it marks the entitlement provisioned without leaving Slack, and the message updates to confirm.
After granting access in the external system, the provisioner marks the entitlement complete in Ravenna through either path.
The Slack DM goes to the ticket assignee. If the ticket is unassigned, the prompt only appears on the ticket itself, so make sure manual access requests get routed to an owner.

​
Ticket closure

When every access request on a ticket reaches a provisioned state, Ravenna moves the ticket to Done automatically. This applies whether provisioning happened through an identity provider or was confirmed manually, and it also applies when only some of the requested access could be granted.You do not need a workflow to close access request tickets.

​
Workflow triggers

The Entitlement Status Changed trigger fires when an entitlement changes status. Configure it to trigger on one or more statuses to notify requesters, alert IT on failures, or fan out across multiple outcomes.

​
Use entitlements in workflows

The Search Entitlements action finds entitlements by application, user, or status. It returns only active entitlements unless you add a status filter. The action outputs entitlementIds and a deduplicated list of userIds that later steps can use.For example, pair a Cron trigger with Search Entitlements to run a weekly sweep of everyone with active access to an application. Then pass userIds to a Send Email step or a bulk Okta action.The Revoke Entitlement action revokes a list of entitlements. Ravenna performs the revocation as your organization’s Ravenna bot user. Add an optional Revoke Note to record the reason. To remove stale access on a schedule, pass the entitlementIds output of Search Entitlements into Revoke Entitlement.
Learn about workflow triggers and actions
Last modified on October 18, 2026