RoPE calculation overview
RoPE (Role and Policy Engine) recalculates an identity's access whenever a configured calculation-affecting event occurs. During recalculation, RoPE evaluates assignments, policies, hierarchies, accounts, provisioning claims, configured extensions, and compliance rules to determine the calculated (desired) access state for an identity. The calculated state is then compared with the actual state imported from connected systems before provisioning actions are generated.
The following sections describe RoPE from two perspectives: first, how the RoPE service executes scheduled work, and second, how an individual identity is evaluated during a calculation cycle.
RoPE service execution
RoPE runs as a service that performs recurring tasks at scheduled intervals. These tasks keep the calculation queue up to date, process queued identities, and maintain calculation-related data.
The service performs three main types of recurring tasks:
- Calculation tasks
- Queueing tasks
- Daily maintenance tasks
Calculation tasks
Calculation tasks run frequently and perform the main RoPE calculation cycle.
A calculation cycle consists of the following high-level steps:
- Populate the queue.
- Process the queue.
- Process a batch of identities.
- Prepare the batch.
- Calculate each identity in the batch.
During batch preparation, RoPE prepares the supporting calculation data and ensures that the required metadata exists in the RoPE database. It then loads the data required for the calculation, including:
- Support data, such as properties, systems, resource types, account types, and account resources
- Current calculation results
- Direct assignments
- Actual assignments imported from connected systems
- Provisioning claims
- Assignment policies
- Contexts
- Resources
After the batch has been prepared, RoPE calculates each identity in the batch.
During identity calculation, RoPE emits events after individual calculation steps complete. Configured RoPE extensions can subscribe to these events and execute custom logic that may modify the current calculation results before the calculation continues.
👉 For more information, see:
Queueing tasks
Queueing tasks run periodically to ensure that relevant identities are added to the calculation queue.
These tasks include queueing identities with recent assignment activations or expirations. If configured, RoPE can also periodically queue identities for recalculation.
👉 For more information, see Queuing.
Daily maintenance tasks
Daily maintenance tasks run periodically to maintain calculation reliability and clean up historical data.
These tasks include:
- Re-queueing identities where the most recent calculation failed.
- Deleting old queue items.
- Deleting old cycle run entries.
The RoPE calculation flow describes how RoPE determines the calculated access state for an identity.
The RoPE service execution describes how the RoPE service runs operationally: how often it performs calculation cycles, how it populates and processes the queue, and how it maintains calculation data.
In other words, the service execution controls when and how calculation work is performed, while the calculation flow describes how access is evaluated for each identity.
RoPE calculation flow
This section describes the high-level logical sequence of the RoPE calculation process.
During identity calculation, RoPE emits events after individual calculation steps complete. Configured RoPE extensions can subscribe to these events and execute custom logic at multiple points in the calculation.
Recalculation triggers
The process is initiated when a configured calculation-affecting event occurs. The exact set of events depends on the RoPE configuration and configured extensions. Typical triggers include:
- Identity property or organizational unit changes
- Role, assignment policy, or resource structure changes (affecting all identities covered by the definition)
- Segregation of Duties (SoD) rule changes
- Time-based events, such as assignment validity periods starting or expiring
When such a change is detected, all affected identities are marked for recalculation.
👉 For more information, see:
Identity queue
Marked identities are placed in the identity queue and remain queued until RoPE collects them for processing.
The queue is priority-based: higher-priority recalculations, for example, a single identity changed by a lifecycle event, run before lower-priority bulk recalculations, such as a policy change affecting thousands of identities.
👉 For more information, see Queuing.
Batch processing
From the queue, RoPE collects identities and processes them in batches, allowing parallel execution and controlled throughput during large-scale recalculation. Each batch then enters the calculation pipeline.
👉 For more information, see Queuing.
Data loading phase
Before evaluation begins, RoPE loads everything the calculation needs into a consistent calculation context:
- Identity attributes and direct assignments
- Roles, role hierarchies, and assignment policies
- Resource definitions and hierarchies
- Accounts and actual assignments imported from connected systems (the actual state)
- Open provisioning claims
- Survey verdicts and approval decisions
- Segregation of Duties rules
- Auto account configuration
👉 For more information, see Identities.
Evaluate direct assignments
After the calculation context has been loaded, RoPE evaluates the identity's direct assignments.
Direct assignments, such as manually assigned roles and resources, form the initial calculated access model before additional assignments are derived through assignment policies and resource or role hierarchies.
👉 For more information, see Assignments.
Evaluate assignment policies
RoPE evaluates assignment policies whose conditions match the identity's data. Matching policies generate additional role or resource assignments, keeping access aligned with identity attributes and organizational context.
👉 For more information, see Assignments.
Resolve resource and role hierarchies
RoPE resolves inherited access by evaluating the configured resource and role hierarchies throughout the calculation.
An assignment to a parent resource expands to the child resources it contains, following the configured hierarchy.
RoPE also derives implicit assignments: when an identity already holds all resources contained in a compound resource, the compound resource itself is assigned implicitly.
👉 For more information, see Assignments.
Evaluate provisioning claims
Provisioning claims represent assignments that have been sent to a connected system for provisioning but not yet confirmed by an import.
During calculation, a claim acts as a temporary stand-in for the actual state: RoPE waits for the claim to be confirmed or to expire before issuing a new provisioning task for the same assignment.
This prevents duplicate provisioning while changes are in flight.
👉 For more information, see Provisioning claims.
Process auto accounts
If auto account functionality is enabled, RoPE next evaluates account creation and lifecycle rules. These may create accounts automatically, link imported accounts to identities (considering the configured trusted systems), or update the account lifecycle. Accounts are resolved before constraint evaluation because calculated assignments are resolved per account.
👉 For more information, see Accounts.
Evaluate Segregation of Duties (SoD)
RoPE evaluates the calculated assignments against the configured Segregation of Duties (SoD) rules. Conflicts are detected, violations are identified, and mitigations are applied where configured. Depending on the configuration, violations may block assignments or be flagged for review.
👉 For more information, see Policy check.
Apply RoPE extensions
RoPE extensions provide configurable extension points throughout the calculation process rather than representing a single calculation phase.
Depending on the configured extension set, extensions can subscribe to RoPE events emitted during calculation and execute custom logic at multiple stages of the calculation process:
- Modify calculated assignments
- Resolve attribute values used for provisioning
- Influence account resolution
- Control how constraint violations are handled
- Extend the standard calculation logic
Because extensions are invoked at configured points, the effective calculation flow may differ between installations.
👉 For more information, see Extension model.
Aggregate all assignments
After all calculation stages have completed, RoPE consolidates the calculated assignments into the effective assignment model.
The aggregation combines:
- Direct assignments
- Policy-generated assignments
- Assignments derived from resource and role hierarchies
- Implicit assignments
- Survey verdicts and approval decisions
- Provisioning claims
- Account resolution results
- Segregation of Duties evaluation results
- Changes introduced by configured RoPE extensions
This consolidated model represents the final calculated (desired) state used to produce the effective assignment state.
👉 For more information, see Assignments.
Final effective assignment state
After the calculated assignments have been aggregated, RoPE produces the final effective assignment state. This includes the identity's effective roles and resource assignments, derived entitlements, account state decisions, and Segregation of Duties outcomes. This state forms the basis for provisioning actions.
👉 For more information, see Compliance status.
Store result and trigger provisioning
Finally, RoPE compares the calculated (desired) state with both the previous calculation result and the actual state imported from connected systems. The result is stored only if a change is detected. Any differences between the desired and actual state generate provisioning tasks that keep connected systems synchronized with the calculated access model (reconciliation).
👉 For more information, see: