Entitlement management

Learn about entitlement management tool scopes, features, and capabilities, with sample workflows and example prompts.

Early Access release

Tool name
okta_identity_governance
Okta scopes
okta.governance.entitlements.read, okta.governance.entitlements.manage, okta.governance.collections.read, okta.governance.collections.manage, okta.governance.labels.read, okta.governance.labels.manage, okta.governance.resourceOwner.read, and okta.governance.resourceOwner.manage

What you can do

  • List, retrieve, create, update, replace, and delete entitlements
  • List, retrieve, create, replace, and delete entitlement bundles
  • Create and manage collections of resources and assign principals to them
  • Create and manage grants with three grant types: CUSTOM, ENTITLEMENT-BUNDLE, and POLICY
  • Revoke a principal's access to entitlement values, entitlement bundles, or apps
  • Create, update, assign, and unassign labels to resources
  • Configure and manage resource owners and their assignments
  • Retrieve principal access profiles and entitlement history
  • Use cursor-based pagination with a minimum of 20 and maximum of 200 items per page
  • Use token-optimized TSV responses to reduce LLM token usage
  • Use scope-based access control

Sample use cases

Use case Prompt Result
Give user a temporary entitlement that will expire automatically after the engagement ends. I want the user's access tied to a clear end date and timezone so the grant is easy to audit and doesn't stay around longer than needed. Create a custom access grant for Alice Johnson to App A for the Contractor Read-Only entitlement, that expires on 2026-12-31, set in the America/Chicago time zone. A custom-duration grant is created with the expiration date and timezone populated, so the user's access is time-bound and automatically revokes when it expires.
The admin is cleaning up an existing entitlement before a rollout and wants it updated in one step, with the name corrected, the description refreshed, and a new value added so the access model stays consistent from day one. Update the Contractor Read-Only entitlement in one request: rename it to Contractor Standard Access, update its description to 'Read-only access for contractor accounts,' and add a new value called Contractor-Tier2 with external value CTR_TIER2. The entitlement is updated with the new name, description, and value.