My settings (End user only)

Learn about governance settings tool scopes, features, and capabilities, with sample workflows and example prompts.

Early Access release

Tool name

okta_identity_governance

Okta scopes

okta.governance.principalSettings.read and okta.governance.principalSettings.manage

What you can do

• Retrieve your own governance settings, including delegate appointments, permissions, and assignment scope
• Update your delegate settings by appointing or replacing a delegate
• Revoke your current delegate by setting appointments to an empty array
• Add optional delegate appointment metadata such as note, start time, and end time
• List users who are eligible to be assigned as your delegate
• Filter eligible delegate users by first name or last name prefix
• Return eligible delegate users in a single response (no cursor pagination in output)
• Restrict actions based on your granted OAuth scopes

Sample use cases

Use case	Prompt	Result
The admin is going on leave soon and wants to make sure governance approvals are still covered during that period. The admin wants to find an eligible delegate, choose an active user, and assign that person for a specific time window so approval work continues without interruption.	First find users eligible to be my governance delegate. Pick one active user from the results. Then appoint that user as my governance delegate with a start time one week from now and an end time one month from now.	Eligible delegate candidates are discovered, one active user is selected, and a time-bounded delegate appointment is created for the user.
The admin wants to confirm that governance delegation is already set up correctly before going on leave, and only make a change if coverage is missing. The admin wants to check current settings first, then assign an eligible delegate only when no delegate is configured.	I want to make sure my governance delegate is properly set up. Can you pull my settings and then also update the delegate if it's missing?	Current governance settings are retrieved first; if delegate is missing, an eligible delegate is discovered and appointed. If already configured, no unnecessary update is made.