Violations

After a policy runs, Zluri records every identity that matched the toxic combination as a violation. View and manage violations from two places:

• Global violations page: Navigate to IGA > SoD > Violations in the left navigation to see all violations across every policy in your organization.
• Per-policy Violations tab: Open a policy from Policy Library and select the Violations tab to see violations scoped to that policy only.

View violations

Navigate to IGA > SoD > Violations to open the global violations page.

The violations table shows the following columns.

Use Open Violations to show only unresolved violations. Use High Severity Violations to show only High severity violations. Select the filter icon to refine the list by additional criteria.

Select the three-dot menu at the top right of the table to Refresh the list or change the View Density between Compact and Comfortable.

Violation statuses

Each violation moves through a series of statuses from detection to resolution. The following table describes every possible state.

Open and Remediation In Progress are active states, Zluri is still processing the violation. All other statuses are terminal and no further automatic action occurs once a violation reaches them.

Violation lifecycle

Understanding how a violation moves through statuses helps you know what to expect after each policy run.

Detection

When a policy runs, Zluri checks every identity in scope against the configured rules. For each identity that breaks a rule:

• If the identity has a pre-configured exemption, Zluri creates the violation as Exempted.
• Otherwise, Zluri creates the violation as Open.

Automated remediation

If the policy is in Enforce mode with a Playbook configured, Zluri triggers remediation automatically once it detects all violations for that run.

• The violation moves to Remediation In Progress.
• The Playbook runs in the background.
• Zluri updates the status based on the outcome: Remediated if the Playbook succeeds, Partially Remediated if it partially succeeds, or Remediation Failed if it fails.

If the policy is in Monitor mode, violations stay Open. Zluri does not trigger remediation.

Manual actions

At any point, manually update a violation:

• Mark it as Remediated if you resolved it outside Zluri.
• Grant an exemption to move it to Exempted.
• Reopen a violation in a failed state.

Subsequent policy runs

When the same policy runs again, Zluri marks existing Open violations for the same identity as Superseded and creates fresh Open violations. This keeps the violation list current with the latest detection run.

Status flow at a glance

Policy runs
    │
    ├── Identity has exemption ──────────────────→ Exempted
    │
    └── No exemption ──────────────────────────→ Open
              │
              ├── Monitor mode ─────────────────→ stays Open
              │
              └── Enforce mode ──→ Remediation In Progress
                        │
                        ├── Playbook succeeds ──→ Remediated
                        ├── Partial success ────→ Partially Remediated
                        └── Playbook fails ─────→ Remediation Failed

Next policy run → old Open violations → Superseded

Policy run statuses

Each time a policy runs, Zluri creates an execution record that rolls up the outcome across all violations in that run. Zluri recalculates the execution status automatically every time an individual violation status changes.

The following table describes each execution status.

Understand a violation

Select a violation row or select View from the row actions menu to open the violation detail drawer.

The drawer has two tabs: Summary and Related.

Summary tab

The drawer header shows the policy name and version, the identity name, and four status badges: Severity (Low, Medium, or High), Recurring (appears when the same identity has been detected in multiple runs), Status, and Enforcement Mode. A timestamp shows when Zluri first detected the violation.

Action buttons in the header: Mark as remediated | Exempt | copy link icon.

If the policy runs in Monitor mode, an info banner reads: "This policy is currently in Monitor Mode. No remediation playbooks will run automatically. You must review and resolve this violation manually."

The Why was this flagged section shows Set A and Set B cards side by side. Each card lists the Matching Entitlements — the account, application, and entitlement identifiers that triggered the match.

The Violation Details panel on the right shows the following fields.

Below Violation Details, the Policy Details section shows the Policy Name and version, Execution ID (links to the policy run record), and Trigger Event (for example, Manual or Scheduled).

The Remediation section describes the remediation action. In Monitor mode it reads: "Policy is in Monitor Mode. No remediation actions will run automatically."

Related tab

The Related tab has two sections.

Related Violations lists all prior violation records for the same identity and policy. The table shows Violation ID, Run ID, Policy Name, Identity Name, and Status. Use the Open Violations filter to show only unresolved records.

Related Exemptions lists any exemptions linked to this identity for this policy. The table shows Exemption ID, Status, Policy Name, Identity Name, and Reason. Use the Active Exemptions filter to show only current exemptions.

Resolve a violation in Enforce mode

When Zluri detects a violation in Enforce mode, it acts based on the Violation Handling shape you configured. Zluri either routes a task to the configured assignee or automatically executes the default-side Playbook.

When the assignee decides

Steps

1. Open the violation to review the identity and matching entitlements. The Why was this flagged section shows the Set A and Set B cards side by side, each listing the matching entitlements with the app and account type.
2. Select Remediate on the Set A or Set B card to choose which set to revoke.
3. Confirm the action. Zluri runs the Playbook configured for the selected set and updates the violation status to Remediated.

Use this option when you want a human to review the full context before revoking access.

When the system chooses the default side

Zluri automatically runs the configured Playbook for the pre-selected set. No manual action is needed. Zluri updates the violation status to Remediated after the Playbook completes.

Use this option for high-confidence conflicts where the correct set to revoke is always the same.

Export violations

Select Export CSV from the violations list to download all violation records for audit evidence. The export includes the violation record, remediation actions taken, and exemption details.