The rule that keeps access correct runs itself.
The rule is a workflow. It runs on the directory change itself, and every step it skips says why.
Govern, policies and workflows

The rule that keeps access correct lives in someone’s head, or in a runbook nobody opens.
How it works
A policy binds a trigger and a population to one reusable workflow, and one recipe then serves many rules
Workflows are versioned and each execution keeps an immutable snapshot of the version that ran
Outbound API and webhook steps pass an SSRF guard before they are allowed to call anything
Ask the specialist that owns this work.
Ask in your own words. The Policy and Workflow Agent runs as you, and any action it can take ships off until an admin turns it on.
Policy and Workflow Agent
Drafts and tunes the automation rules that keep access correct between reviews.
- You asked: Alert me when a contractor gets an admin role
Nuvio answered: Contractors picked up admin roles twice this quarter. Here is the rule that would have caught both. Turn it on?
Ready for youThe rule is drafted for you to enable
Govern, workflows