WIP Access requests section overhaul

[mindymo]

What this PR does

Complete overhaul of the Access requests docs section. This is a multi-step project — this PR will accumulate changes over several work sessions. It is not ready to merge until all steps are complete.

Background

The Access requests section had grown into a tangled mix of overlapping content:

• The main access-requests.mdx page covered four distinct topics (visibility config, provisioning, request settings, and entitlement provisioning) with no clear organization
• A new product feature (entitlement configuration rules) replaced the old "Default config rules" UI but the docs didn't reflect this
• Three IdP quick-start guides (Okta, OneLogin, Entra) were word-for-word identical
• Provisioning content lived in the wrong section

Simultaneously, a new product feature split the old "Default config rules" into two separate tools:

• Default access profile rule — controls catalog visibility (who can request)
• Entitlement configuration rules — controls request settings (CEL-based, up to 5 rules, priority-ordered)

Agreed IA

The new section structure:

Access requests
├── Overview: How access requests work  ← NEW (this commit)
├── Get started with access requests
│   ├── Self-service requests            (light refresh)
│   ├── Get started with SSO app requests ← NEW (consolidates Okta + OneLogin + Entra)
│   ├── [Okta app requests]              → redirect to SSO guide
│   ├── [OneLogin app requests]          → redirect to SSO guide
│   ├── [Entra app requests]             → redirect to SSO guide
│   ├── AWS JIT access                   (update Step 2 UI)
│   ├── GCP JIT access                   (update Step 2 UI, beef up connector step)
│   └── On-call access control           (add access profiles primer to intro)
├── Configure access requests            (strip provisioning content, update for new UI)
├── Entitlement configuration rules      (add: 5-rule limit, auto-rule, AI expression, lock interaction)
├── Emergency access                     (add: enable via config rules procedure)
└── Add instructions and request forms   (no changes needed)

Content moving out of Access requests → Applications > Provisioning:

• "Set how app accounts are provisioned" → account-provisioning.mdx
• "Set how app accounts are deprovisioned" → account-provisioning.mdx
• "Set how an entitlement is provisioned" → provisioning.mdx

The precedence model (key concept for this overhaul)

Catalog visibility (who can request):

1. Per-entitlement Access controls (access profiles + standard audience)
2. Default access profile rule (by resource type, app-wide)
3. App standard audience (the audience pool itself)

Request settings (how requests are processed):

1. Locked entitlement — Lock configuration bypasses all config rules
2. Entitlement configuration rules — CEL-based, first match wins (max 5)
3. Entitlement settings — fills gaps left by a matching rule, or applies in full if no rule matches
4. App-level defaults (Access requests card) — auto-represented as the "Access request defaults" config rule
5. Built-in fallback — app owner approval

Work sequence

• Step 1: Write new overview page (access-requests-overview.mdx) + nav update
• Step 2: Write consolidated SSO guide (qs-sso-app-requests.mdx) + redirects from 3 retired pages
• Step 3: Refresh remaining scenario guides (self-service, AWS JIT, GCP JIT, on-call)
• Step 4: Overhaul access-requests.mdx — strip provisioning, update for new UI split
• Step 5: Update entitlement-config-rules.mdx — 5-rule limit, auto-rule, AI expression, lock interaction, request form
• Step 6: Move provisioning content to Applications > Provisioning
• Step 7: Update emergency.mdx + finalize docs.json (redirects, nav cleanup)

Notes for next session

• The SSO guide (Step 2) should use Okta as the worked example with callouts for OneLogin/Entra differences. The key update from the old guides: Step 4 (configure for self-service) now uses the Default access profile rule UI, not the old "Default config rules" toggle.
• The qs-sso-app-requests.mdx link in the overview page will be a 404 until Step 2 is complete.
• All scenario guides that reference the Entitlement management card need their config step updated — the old drawer with "Enable configuration rules" toggle no longer exists; it's now the Default access profile rule.
• The auto-generated "Access request defaults" rule is created when admins set an app-level request policy. Worth calling out explicitly so existing admins understand where their old settings went.

🤖 Generated with Claude Code

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
conductorone	🟢 Ready	View Preview	Jul 29, 2026, 10:51 PM