--- updatedAt: 2026-08-27T14:44:04.000Z agentTools: projectIndex: https://help.zluri.com/llms.txt --- # Violations # Violations After a policy runs, Zluri records every identity that matched the toxic combination as a violation. View and manage violations from two places: * **Global violations page**: Navigate to **IGA** > **SoD** > **Violations** in the left navigation to see all violations across every policy in your organization. * **Per-policy Violations tab**: Open a policy from **Policy Library** and select the **Violations** tab to see violations scoped to that policy only. ## View violations Navigate to **IGA** > **SoD** > **Violations** to open the global violations page. ![Global SoD Violations page showing 497 Policy Violations with columns for Violation ID, Run ID, Policy Name, Identity Name, and Severity with Open and Superseded status badges]() The violations table shows the following columns. | Column | Description | | :------------ | :---------------------------------------------------------------------------------------------- | | Violation ID | The unique identifier for this violation record. Select it to open the violation detail drawer. | | Run ID | The identifier of the detection run that created this violation. | | Policy Name | The policy that raised this violation. Select it to open the policy detail page. | | Identity Name | The identity that matched the toxic combination. | | Severity | The severity level set on the policy: Low, Medium, or High. | | Detected At | The date and time Zluri first detected this violation. | | Policy Owner | The owner of the policy that raised the violation. | | Actions | Three-dot menu with **Copy Link** and **View** options. | Use **Open Violations** to show only unresolved violations. Use **High Severity Violations** to show only High severity violations. Select the filter icon to refine the list by additional criteria. Select the three-dot menu at the top right of the table to **Refresh** the list or change the **View Density** between **Compact** and **Comfortable**. ## Violation statuses Each violation moves through a series of statuses from detection to resolution. The following table describes every possible state. | Status | Meaning | | :---------------------- | :----------------------------------------------------------------------------------------------------------------------------------------------- | | Open | Zluri detected a conflict. No action taken yet. | | Exempted | The identity has an exception, either pre-configured on the policy or granted manually. Zluri re-opens the violation when the exemption expires. | | Remediation In Progress | Zluri triggered a Playbook to fix the violation. Waiting for the Playbook to complete. | | Remediated | The Playbook ran successfully and resolved the violation. | | Partially Remediated | The Playbook ran but resolved only some of the conflicting entitlements. | | Remediation Failed | The Playbook ran but failed entirely. | | Superseded | A newer run of the same policy detected the same conflict. The old record is replaced by the updated violation. | | Failed | A system error occurred during processing. This is not a Playbook failure. | **Open** and **Remediation In Progress** are active states, Zluri is still processing the violation. All other statuses are terminal and no further automatic action occurs once a violation reaches them. ## Violation lifecycle Understanding how a violation moves through statuses helps you know what to expect after each policy run. ### Detection When a policy runs, Zluri checks every identity in scope against the configured rules. For each identity that breaks a rule: * If the identity has a pre-configured exemption, Zluri creates the violation as **Exempted**. * Otherwise, Zluri creates the violation as **Open**. ### Automated remediation If the policy is in Enforce mode with a Playbook configured, Zluri triggers remediation automatically once it detects all violations for that run. * The violation moves to **Remediation In Progress**. * The Playbook runs in the background. * Zluri updates the status based on the outcome: **Remediated** if the Playbook succeeds, **Partially Remediated** if it partially succeeds, or **Remediation Failed** if it fails. If the policy is in Monitor mode, violations stay **Open**. Zluri does not trigger remediation. ### Manual actions At any point, manually update a violation: * Mark it as **Remediated** if you resolved it outside Zluri. * Grant an exemption to move it to **Exempted**. * Reopen a violation in a failed state. ### Subsequent policy runs When the same policy runs again, Zluri marks existing **Open** violations for the same identity as **Superseded** and creates fresh **Open** violations. This keeps the violation list current with the latest detection run. ### Status flow at a glance ``` Policy runs │ ├── Identity has exemption ──────────────────→ Exempted │ └── No exemption ──────────────────────────→ Open │ ├── Monitor mode ─────────────────→ stays Open │ └── Enforce mode ──→ Remediation In Progress │ ├── Playbook succeeds ──→ Remediated ├── Partial success ────→ Partially Remediated └── Playbook fails ─────→ Remediation Failed Next policy run → old Open violations → Superseded ``` ## Policy run statuses Each time a policy runs, Zluri creates an execution record that rolls up the outcome across all violations in that run. Zluri recalculates the execution status automatically every time an individual violation status changes. The following table describes each execution status. | Status | Meaning | | :-------------------- | :---------------------------------------------------------------------------- | | Running | Violations are still being processed or remediation is in progress. | | Success | All violations reached a resolved state: Remediated, Exempted, or Superseded. | | Failed | All violations ended in a failure state. | | Completed with Errors | Mixed outcome — some violations resolved, some failed. | ## Understand a violation Select a violation row or select **View** from the row actions menu to open the violation detail drawer. ![Violation detail drawer open on the Summary tab, showing the policy name and version, identity name, status badges (Low, Recurring, Open, Monitor), the Monitor Mode info banner, the Why was this flagged section with Set A and Set B matching entitlements, and the Violation Details panel on the right]() The drawer has two tabs: **Summary** and **Related**. ### Summary tab The drawer header shows the **policy name and version**, the **identity name**, and four status badges: **Severity** (Low, Medium, or High), **Recurring** (appears when the same identity has been detected in multiple runs), **Status**, and **Enforcement Mode**. A timestamp shows when Zluri first detected the violation. Action buttons in the header: **Mark as remediated** | **Exempt** | copy link icon. If the policy runs in Monitor mode, an info banner reads: "This policy is currently in Monitor Mode. No remediation playbooks will run automatically. You must review and resolve this violation manually." The **Why was this flagged** section shows Set A and Set B cards side by side. Each card lists the **Matching Entitlements** — the account, application, and entitlement identifiers that triggered the match. The **Violation Details** panel on the right shows the following fields. | Field | Description | | :--------------- | :----------------------------------------------------------------------- | | Assignee | The person assigned to review this violation. | | Violation ID | The unique identifier for this violation. | | Status | The current status of this violation. | | Severity | The severity level inherited from the policy. | | Enforcement Mode | Monitor or Enforce. | | Detected at | The date and time Zluri detected this violation. | | Occurrence | The number of violations detected for this identity in the last 30 days. | Below Violation Details, the **Policy Details** section shows the **Policy Name** and version, **Execution ID** (links to the policy run record), and **Trigger Event** (for example, Manual or Scheduled). The **Remediation** section describes the remediation action. In Monitor mode it reads: "Policy is in Monitor Mode. No remediation actions will run automatically." ### Related tab ![Violation detail Related tab showing the Related Violations table (Violation ID, Run ID, Policy Name, Identity Name, Status columns) and the Related Exemptions table (Exemption ID, Status, Policy Name, Identity Name, Reason columns)]() The **Related** tab has two sections. **Related Violations** lists all prior violation records for the same identity and policy. The table shows Violation ID, Run ID, Policy Name, Identity Name, and Status. Use the **Open Violations** filter to show only unresolved records. **Related Exemptions** lists any exemptions linked to this identity for this policy. The table shows Exemption ID, Status, Policy Name, Identity Name, and Reason. Use the **Active Exemptions** filter to show only current exemptions. ## Resolve a violation in Enforce mode When Zluri detects a violation in Enforce mode, it acts based on the Violation Handling shape you configured. Zluri either routes a task to the configured assignee or automatically executes the default-side Playbook. ### When the assignee decides ### Steps 1. Open the violation to review the identity and matching entitlements. The **Why was this flagged** section shows the Set A and Set B cards side by side, each listing the matching entitlements with the app and account type. 2. Select **Remediate** on the Set A or Set B card to choose which set to revoke. 3. Confirm the action. Zluri runs the Playbook configured for the selected set and updates the violation status to **Remediated**. Use this option when you want a human to review the full context before revoking access. ### When the system chooses the default side Zluri automatically runs the configured Playbook for the pre-selected set. No manual action is needed. Zluri updates the violation status to **Remediated** after the Playbook completes. Use this option for high-confidence conflicts where the correct set to revoke is always the same. ## Export violations Select **Export CSV** from the violations list to download all violation records for audit evidence. The export includes the violation record, remediation actions taken, and exemption details.