Effect matrix
Every policy is one sentence: who, an effect, and what. This page compares all six effects side by side, so you can see what each one does to access and which settings it offers before you open the builder.
What each effect says and does
Effect | The sentence it writes | What Ploy does |
|---|---|---|
Gets | "People where department is Engineering get GitHub" | Grants this access and keeps it true from then on, through the resource's provisioning strategy. |
Never gets | "Everyone never gets Production AWS" | Denies this access and surfaces anyone who has it. |
Can request | "Everyone can request Slack for up to 3 months at a time, extendable, reason required" | Nothing on its own. It decides who may ask, who approves, and on what terms. |
Can't request | "People where employment type is Contractor can't request Everything" | Hides the target from those people's access catalog, and refuses a direct ask. |
Must satisfy | "Anyone's access to Salesforce must satisfy: multi-factor authentication is enabled" | Attaches a standing requirement to access another policy granted. Ploy acts on anyone who stops meeting it. |
Remove when unused | "Anyone's access to Jira Service Management unused for 30 days is removed" | Removes access that has gone a set number of days without being used. |
Does the effect move access?
Gets, Never gets and Remove when unused change real access. A save starts a pass within seconds, and a safety sweep runs every 15 minutes.
Must satisfy grants nothing and takes nothing away by itself, but access is held only while the condition is true, and asking for it without the condition is refused.
Can request and Can't request never move access. They decide what happens when somebody asks.
Enforcement, manual overrides and the unused threshold
Effect | Enforcement | Manual overrides | Days without use |
|---|---|---|---|
Gets | Suggest only, Auto-suspend, Auto-revoke | Reverse, Flag, Log | Not offered |
Never gets | Suggest only, Auto-suspend, Auto-revoke | Reverse, Flag, Log | Not offered |
Can request | Not offered | Not offered | Not offered |
Can't request | Not offered | Not offered | Not offered |
Must satisfy | Suggest only, Auto-suspend, Auto-revoke | Reverse, Flag, Log | Not offered |
Remove when unused | Suggest removal, Remove automatically | Not offered | Required, 60 by default |
Enforcement defaults to Suggest only and manual overrides default to Flag. Enforcement is not offered on the request pair because a request policy holds no access to enforce against.
Ladder, terms, condition and org-wide targets
Effect | Approval ladder and terms | Condition | Can target Everything |
|---|---|---|---|
Gets | No | No | No |
Never gets | No | No | Yes |
Can request | Yes | No | Yes |
Can't request | No | No | Yes |
Must satisfy | No | Required | No |
Remove when unused | No | No | No |
The builder offers the approval ladder, the Auto approve toggle and the terms rows (Maximum duration, Extensions, Reason) on Can request only. A Must satisfy policy cannot be saved without at least one condition.
Identity requirements by effect
Identity requirements narrow a policy about people to certain accounts, for example only an account whose name ends with -admin. They are offered on policies about people only, and today they are refused in three places:
on a policy that targets Everything,
on a policy whose target is an app,
on Must satisfy and Remove when unused.
A policy whose population is NHIs cannot carry them at all, because it already selects accounts directly.
Good to know
Everything is available to deny and request effects only. A granting policy has to name a specific app or permission.
A maximum access length is not something a policy can state yet. Set that on the resource itself.
One card can hold several rows. When you pick more than one target, the preview says "Saves as N policy rows, shown and edited as one card", and an edit applies to all of them.
On-call status can only be used to choose who a request policy covers, never who a grant or deny covers.
A time window can only be set on a policy that lets people request access.
Flagging unused access is no longer an effect of its own. Write Remove when unused and set it to Suggest removal instead, so a person approves each removal. Auto-suspend is refused on that effect.
When two policies reach the same person and the same target: a refusal beats a grant, refusing the ask beats permission to ask, and conditions attach rather than compete.