CA Identity Manager Implementation Guide - CA Technologies

Develop a Deployment PlanNote the following when deploying identity policies:■■Consider initially creating identity policies that grant entitlements that do notrequire workflow approvals. This allows you to deploy identity policieswithout having to define workflow processes, approval forms, and approvermodels.Before creating identity policies, you should be familiar with other methodsof implementing business rules in CA Identity Manager, such as datavalidation rules, logical attributes, business logic task handlers, andworkflow processes, to determine which method provides the best solution.Note: For more information about these methods, see the AdministrationGuide and the Programming Guide for Java.■■Identity policies are an efficient way to assign entitlements in CA IdentityManager, however, they may significantly impact performance (seepage 85).For the initial deployment of user tasks, consider removing or hidingrelationship tabs, such as Roles tabs, that manage the same entitlements asidentity policies. This prevents the risk of unauthorized entitlements andprevents the potential performance impact of improperly constructed roles.Note: For more information about identity policies, see the AdministrationGuide.Deploy Workflow ApprovalsWorkflow approvals can add an additional level of security and automation toyour Identity Manager implementation.Deploying workflow approvals requires the following tasks:1. Decide which events or tasks require approvals.2. Define the set of approvers, called participants, for each workflow process.Note: All participants are determined dynamically by participant resolvers.To maintain good performance, limit the number of participants to thirtyusers.3. Configure approval forms.4. Define custom workflow processes, if needed.Chapter 4: Planning Your Implementation 61