Give every access decision an owner.
Salesforce User Access Policies automate assignments. Sforce.ai connects access to business requests, configured approvals, manager reviews and operational follow-through.
For Salesforce teams that need to explain who authorised access, how it changed and whether it still belongs.
The assignment is one part of the decision.
An automated grant does not, by itself, explain the business approval, the exception or the next review.
Make authorisation visible
Use request context and configured sequential approval tasks to give the business decision a clear place in the process.
Keep ownership after provisioning
Ask eligible managers to review continuing user/Persona access through configured recertification campaigns.
Give exceptions a next step
Connect request status, allocation records and exception references with defined hold and recovery routes.
Start with native controls. Assess the surrounding process.
UAP and UAG have overlapping assignment targets. The distinction is the governance process your team needs to operate.
| Control need | Salesforce User Access Policies | Sforce.ai UAG |
|---|---|---|
| Repeatable assignment | Configured grants and revocations across six documented entitlement types. | Persona and Business Unit mappings drive request-based provisioning. |
| Business authorisation | Business approvals need a surrounding process. | Configured sequential tasks and reviewer decision checks. |
| Continuing access need | Assignment conditions alone do not constitute a manager review campaign. | Eligible user/Persona reviews with Retain or Revoke decisions. |
| Business allocations | Native licence requirements remain the foundation. | Optional BU allocation, reservation and settlement controls. |
| Operational accountability | Recent User Access Changes provides policy-level visibility. | Linked request, approval, allocation and exception context. |
Native scope: Salesforce User Access Policies and policy considerations. This compares the UAP feature with UAG; Salesforce Flow, approvals, Apex and existing IAM tools can also supply surrounding governance.
Your surrounding controls are already covered.
You have clear assignment rules and an existing process for approvals, removals, periodic review and evidence. UAP can be the appropriate assignment tool.
You need the business process connected.
You want a reusable Persona model, request decisions, manager reviews, BU allocations and exception handling within one Salesforce governance process.
Finance to Operations: make the change deliberate.
Alex changes responsibilities. The organisation needs a decision about old access, new access and continuing ownership.
Finance reporting permissions and Finance group membership.
The approved Operations Persona, its entitlements and the new Business Unit.
Request
An authorised operator raises Modify Access against the existing User and selects the target BU and Persona.
Approve
The configured policy routes its approval steps. In this example, Finance ownership is followed by the receiving manager.
Apply and follow up
Apply target details, process the agreed access transition and provision the target Persona. Settle BU allocations where enabled; investigate holds or failures.
Review
A later configured campaign records the eligible manager’s Retain or Revoke decision for the user/Persona access.
Agree the access transition first. Confirm which existing access should end, which shared access should continue and which new access is required. Include continuing access and approved exceptions in the target Persona design before applying the change.
Illustrative configuration; reviewer roles and mappings depend on your organisation’s policies.
Choose controls that match the requirement.
Agree what the process will control, who owns each decision and what evidence is needed.
Temporary access
Temporary Access controls JIT login availability: it unfreezes an existing login and evaluates expiry daily. It does not expire individual Permission Set assignments.
Manager review
Managers review eligible user/Persona access. A Revoke decision initiates the configured user-access lifecycle and may deactivate the User; it is not simply the removal of an individual permission.
Allocations and evidence
Business Unit allocations track internal access allocations, not purchased Salesforce licence inventory. Linked requests and exceptions support follow-up; detailed access snapshots need separate evidence.
Salesforce permissions, field-level security and sharing remain the foundation. When multiple tools can change the same entitlement, agree control ownership and test the interactions.
How Sforce.ai fits your access model.
Does Sforce.ai replace Salesforce User Access Policies?
No. Native UAP may be sufficient when assignment rules and surrounding governance are already covered. Evaluate Sforce.ai when you need connected requests, approvals, manager reviews and operational follow-through.
Can it coexist with Salesforce automation?
Yes, with clear control ownership. Agree which tool manages each access change and test interactions with UAP, Flow, approvals and Apex before enabling overlapping automation.
Does it replace enterprise IAM?
No. Sforce.ai supports access governance within Salesforce. Enterprise identity, cross-application access and wider IAM responsibilities remain with your organisation’s IAM tools and processes.
Bring one real access decision.
Start with an employee move, an approval exception or a recurring review. We can discuss the responsibilities, access scope and evidence your organisation needs.