Assignments and relationships

Assignments and relationships enable you to manage access at scale by decoupling authorization from individual principals. Instead of creating thousands of policies that target specific people, you create role-based relationships and assign them to principals on resources.

Early Access release

Overview

Assignments and relationships implement relationship-based access control (ReBAC) to manage access at scale. Instead of creating individual policies for each principal (user, group, or workload role) on each resource, you define relationships (such as "Owner," "Auditor," or "Operator") and then use assignments to map principals to resources with those relationships. Policies target these relationships, not individual principals, reducing policy complexity and simplifying access management as your organization scales.

Assignments and relationships are built on two core concepts:

Assignments: A container that maps principals (users, groups, workload roles) to resources, with each principal tagged with a relationship. This allows explicit mappings between principals and resources, with each principal tagged by a relationship. For example, an assignment maps the user Bob to a specific Active Directory account with the "Auditor" relationship.
Relationships: Admin-defined named roles that represent how a principal interacts with resources. A relationship is a name and description; it doesn't grant access by itself. Access is granted only when a policy explicitly targets the relationship and the principal holds that relationship on the target resource.

Benefits

Reduced policy sprawl: One relationship-based policy replaces thousands of principal-specific policies.
Simpler onboarding: New team members are added to an assignment; policies automatically apply.
Cleaner audits: A single assignment update event shows exactly who held which relationship on which resource at what time.
Easier maintenance: Managing access becomes about updating assignments, not rewriting policies.

How it works

Only Okta Privileged Access security admins can create and manage relationships, assignments, and assignments policies.

Create an assignment with name, description, and select the resources to include.
Add principals (users, groups, workload roles) to the assignment, tagging each with a relationship.
Create a security policy that targets relationships instead of specific principals.
The policy automatically grants permissions to any principal holding a targeted relationship on any assignment.

Assignments and resource assignment

Okta Privileged Access includes two related but distinct features that use similar terminology:

Assignments (ReBac): The relationship-based feature that's described on this page. Create assignments to map principals to resources and tag them with relationships, then target those relationships in security policies for scalable access control.
Resource assignment (resource admin feature): An existing capability where resource admins assign individual service accounts or resources to resource groups and projects for organizational and management purposes. This is a separate, account-management feature used primarily by resource admins, not a security control mechanism.

Don't confuse the two: Assignments is a security policy mechanism and resource assignment is an account organization feature.

Quotas and limits

See Assignments quotas and limits for team-wide limits on relationships, assignments, resources, and related items.