Reporting as a live view
A report opens as rows you can inspect, not as a file you must order before you can see the answer. The live view is paginated, sortable and scoped to the reader. Export and scheduling remain available as the closure of looking.
One evaluator for view and file
Saved views and reports share the configured-view evaluator. The selected kind, filter, columns, reader scope and masking rules determine both what appears on screen and what can be exported. Reporting does not maintain a second query that can silently drift from the view.
The columns and sort a person picks on a list or report are saved to their account, so they follow them to another device or browser; "Reset to default" in the Columns menu puts both back.
The current reporting vocabulary includes identity-governance rows such as grants, decisions and effective permissions. Object references in cells carry their identifiers so supported rows can drill into the governed object.
Reader scope and masking
Opening a report applies the reader's scope. A manager and an administrator can open the same definition and legitimately see different rows. A restricted reader does not gain broader access because somebody else created or scheduled the report.
Field visibility also applies to exports. A masked column is removed from the file rather than merely hidden in the browser.
Export caps before the click
Before export, the platform evaluates the current result and reports:
- the number of rows selected;
- the cap for each available format;
- whether the current result fits;
- whether a format would truncate.
Viewing is paginated rather than capped. Export limits control file generation, not what an authorized reader may inspect.
Schedules and delivery
A saved report can retain its export and schedule workflow. The report definition still owns delivery configuration, while the live view owns inspection. Point-in-time output remains evidence of what the evaluator returned for that run; it is not a permanently live link.
"As it stood on" and what it can say
A report can be read as it stood on an earlier date. The answer is rebuilt from the recorded history of grants being made and revoked, plus the grants a sync observed. It states how complete that history is. If the date is before the record starts, the report says the record starts on a given date and that the answer is unknown, not that nothing was held; an incomplete history reads "unknown, not empty".
Rows name things as people do: the "Who has access to what" report shows the account's native name and the system's name, not internal keys or ids.
An application's access can be exported as a CSV file from its page. A role with the tenant-wide export right exports any application. An owner exports only an application they own, or one in whose catalogue they own an entitlement; for any other application there is no export button and the export answers as not found. Every export is recorded in the audit trail with the authority it used.
Conditions you pick, not type
A report condition takes its value from the real options where there are any: a system by its name, a status from its list, a person, an entitlement or an account found by search, several at once for "is any of" and "is none of". The condition stores the identifier and the summary sentence shows the name. Free text stays for "contains" and for a column without a list, which today includes the five org dimensions. The options follow the reader's scope and field visibility: a hidden field is not offered, and a restricted reader gets no data-backed list outside identities they may see.
What some catalogue reports leave out
- Identities without a manager lists people only. Non-human identities have an owner, not a manager, and appear in the non-human inventory instead.
- Grant reports skip a grant that is not in the target when its account was retired: nobody holds that access and nothing will create it. A grant still in the target on a retired account stays listed. The list, the export and a scheduled run agree.
- Privileged access names the account on every row, so admin rights on an account no identity is linked to read as that account. A saved copy of the report keeps the columns it was created with; add "Account" through Columns there.
- Lifecycle / JML carries the numbers of the Lifecycle page: joiners, movers and leavers per type with how many were on time, the open exceptions longest overdue first, the slowest events, and the people in scope split by status with non-human identities as one separate number. An empty section says so in words.
The files
A report's PDF, composed or table, comes from one renderer: a header card, a strip with the date it stands on (in the tenant's time zone), the filter in words, the tenant and the scope, then the tables with values by column type ("Yes"/"No", dates, "Never", "No identity linked"), and page numbers. A table over six columns prints in landscape. The Excel export has a bold header row, fitted widths and a filter; CSV is unchanged.
Current limits
- The live report catalogue, open-as-list experience and export/schedule closure are shipped.
- A universal live configuration rail is not yet present on every report view.
- Summary mode is not yet a general reporting primitive.
- Do not infer that a delivered file remains current after its run.
- Delivery history should be read per recorded run; do not claim transparent resend or exactly-once delivery.
See workbench lenses, evidence and signing and API reference.