Policies

Overview

Policies are the rules OrgGuard uses to turn discovered assets into actionable findings. A policy says things like “tell me when a certificate is within 30 days of expiry” or “flag any Connected App without an assigned owner.” When a policy evaluates an asset and the rule matches, OrgGuard creates a Finding and (optionally) sends notifications.

OrgGuard ships three policy types covering the most common governance needs:

• Expiry — raises findings as assets approach or pass their expiration date, with configurable day-based windows and severity.
• Ownership — raises findings on assets that have no assigned owner.
• Unknown Expiry — raises findings on assets whose expiration date can’t be determined.

Who this page is for

Salesforce admins responsible for auth governance policy authoring. If you’re only reading findings, see Findings instead.

OrgGuard ships with six default policies. Four are seeded when you complete the Setup Wizard:

• Certificate Expiry Warning (Expiry)
• Missing Asset Owner — Certificates (Ownership)
• Governance Accountability — Auth Assets (Ownership)
• Unknown Expiry Date (Unknown Expiry)

The other two are seeded automatically on install for Scheduled Job Health Monitoring: Inactive Job Owner and Job Failure Threshold.

You can edit, disable, or delete any of them at any time, and you can create as many additional policies as you need.

---

What you’ll see

Policy Management screen

The card header shows Policy Management with two buttons:

• Create Policy — opens the 5-step policy wizard
• Refresh — reloads the list

The list is a data table with columns:

Column	Notes
Name	The policy’s display name, bold.
Type	Expiry, Ownership, or Unknown Expiry.
Applies To	Comma-separated asset types this policy evaluates.
Enabled	Boolean — checked means the policy is evaluated during scans.
Last Modified	Timestamp of the most recent edit.

Each row has an Actions menu with four items: Edit, Enable, Disable, Delete.

Below the table: pagination (25 rows per page, Previous / Next, and a “Showing X–Y of Z” label).

If no policies exist, an empty state prompts you to create your first policy.

Policy wizard

The wizard is a 5-step modal with a progress bar at the top. A Cancel button in the top-right closes without saving. The footer shows Cancel, Previous (from Step 2 onward), and Next (or Save Policy on Step 5).

Delete confirmation

The delete modal shows a confirmation message. If the policy has open findings, the Delete button is hidden (you’ll see only Cancel) — this is intentional to preserve audit integrity.

---

Common tasks

Task: Create a new policy

Who can do this: OrgGuard Admin.

1. From the Policies tab, click Create Policy.
2. Step 1 — Policy Type and Name
   • Policy Type (required): choose Expiry, Ownership, or Unknown Expiry.
   • Policy Name (required): a descriptive label, e.g. “Certificate Expiry — 90 Day Warning.”
   • Click Next.
3. Step 2 — Configuration
   • Applies to Asset Types (required): move one or more types (Certificate, Connected App, Auth Provider, Named Credential, External Credential, Scheduled Job) from Available to Selected.
   • (Expiry policies only) Expiry Warning Windows (days) (required): comma-separated days. A blank new-policy form defaults to 90,60,30,14. Each value generates a finding at that many days before expiry.
   • Click Next.
4. Step 3 — Severity Mapping
   • For Expiry policies: pick the severity for each window (e.g. 90 → Low, 60 → Medium, 30 → High, 14 → Critical). The severity picker offers Critical, High, Medium, and Low.
   • For Ownership and Unknown Expiry: pick a single Finding Severity.
   • Click Next.

Note

The seeded Certificate Expiry Warning policy uses windows 90,60,30,15,7,1 and assigns Informational to the 90-day window. Informational is not one of the choices in the wizard’s severity picker (Critical/High/Medium/Low) — it’s a valid engine severity that the seeded default uses, but you cannot select it when authoring a policy by hand.

5. Step 4 — Notification Settings
   • Notify Asset Owner (toggle) — when enabled, the asset’s assigned owner (a Salesforce user) receives an alert at their email when a finding is generated.
   • Notify Admin Group (toggle) — when enabled, reveals Admin Group Email (required); that address receives every alert.
   • Deduplication Window (hours) — minimum hours between repeat notifications for the same finding (default: 24). Set higher to reduce noise.
   • Click Next.
6. Step 5 — Review and Save
   • Verify every field. Click Previous if you need to correct anything.
   • Click Save Policy.
7. Expected result: the policy appears in the list with Enabled = true. It will be evaluated on the next scan.

Caution

Policies are only evaluated during a discovery scan. Creating a policy does not retroactively generate findings for existing violations — wait for the next scheduled scan or trigger one manually from Scan Management.

Task: Edit an existing policy

1. In the Policy Management list, open the Actions menu on the row you want to change.
2. Click Edit. The 5-step wizard opens with the policy’s current values loaded.
3. Make changes and click Next through each step (you can skip without editing).
4. On Step 5, click Save Policy.
5. Expected result: the Last Modified column updates; the next scan uses the new configuration.

Task: Disable a policy without deleting it

Use this when you want to stop a policy from generating findings but keep its configuration for later.

1. Open the Actions menu on the row.
2. Click Disable.
3. Expected result: the Enabled column becomes unchecked. The policy is skipped during scans until re-enabled.

To re-enable, click Enable on the same row’s Actions menu.

Task: Delete a policy

Prerequisites: No open findings reference this policy.

1. Open the Actions menu on the row.
2. Click Delete.
3. Confirm in the modal.
4. Expected result: the policy is removed. If open findings exist, the Delete button is hidden — resolve or suppress those findings first (see Findings) and try again.

Caution

There is no undo. Consider Disable instead of Delete if you might want to re-enable later.

Task: Change expiry windows on an existing policy

1. Edit the policy (Actions → Edit).
2. Advance to Step 2 — Configuration.
3. Update the comma-separated days in Expiry Warning Windows.
4. On Step 3 — Severity Mapping, map each new window to a severity. Windows you removed disappear; new windows are assigned a default severity by position — the first window defaults to Low, the second to Medium, the third to High, and the fourth and beyond to Critical. Adjust any of them before saving.
5. Continue to Step 5 and click Save Policy.

Task: Verify a policy is evaluating after creation

1. Create or enable the policy.
2. Trigger a scan manually from Scan Management → Trigger Scan.
3. Wait for the scan to complete (status: Completed).
4. Open the Findings tab and filter by the policy’s Finding Type.
5. Expected result: findings exist for any assets that match the policy’s rule.

---

Policy-type reference

Policy_Type__c	What it evaluates	Produces Finding_Type__c
Expiry	Days-to-expiry against configured windows, per asset type	Expiring Soon, Expired
Ownership	Whether the asset has an assigned owner (CurrentOwnerUserId__c or CurrentOwnerGroupId__c)	Missing Owner
Unknown Expiry	Whether expiration date can be determined	Unknown Expiry

Default expiry-window → severity mapping for the seeded Certificate Expiry Warning policy (windows 90,60,30,15,7,1):

Days before expiry	Severity
90 days	Informational
60 days	Low
30 days	Medium
15 days	High
7 days	Critical
1 day	Critical

A blank new-policy form, by contrast, defaults its windows to 90,60,30,14 — distinct from the seeded policy’s windows above. The Informational severity at the 90-day window is used by the seeded default but is not selectable in the wizard’s severity picker (which offers only Critical/High/Medium/Low).

---

Troubleshooting

Symptom	Likely cause	Fix
New policy doesn’t create findings	No scan has run since policy creation	Trigger a scan from Scan Management; results typically appear within a few minutes.
Policy is disabled and generates nothing	Is_Enabled__c = false	Open the Actions menu → Enable.
Delete button missing in the confirmation modal	Policy has open findings	Resolve, suppress, or reassign open findings first (see Findings).
”Applies to Asset Types” is empty after save	Nothing was selected in Step 2	Edit the policy; move at least one type from Available to Selected.
Admin group didn’t receive the email	Notify Admin Group toggle off, or Admin Group Email blank	Edit the policy; turn on the toggle and fill in the email.
Too many repeat notifications	Deduplication window set too low (e.g. 1 hour)	Edit the policy; raise Deduplication Window (hours) — 24 is a reasonable default.
Severity on findings is unexpected	Severity mapping on the policy doesn’t match expectation	Edit the policy → Step 3; verify each window’s severity.
Can’t open the wizard at all	User lacks OrgGuard Admin permissions	See Permission Sets.

---

FAQ

When do I use Disable vs. Delete? Use Disable when you might re-enable the policy later or want to pause it temporarily. Use Delete only when the policy is genuinely obsolete. Disabling preserves all history; deleting removes the policy record (but keeps existing findings intact).

Can two policies target the same asset type? Yes. Every enabled policy that applies to an asset type is evaluated independently on each scan. If multiple policies match the same asset, you’ll see multiple findings.

How is Severity determined for a finding? For Expiry policies, it’s the severity mapped to the smallest matching window (e.g. at 29 days, the ≤ 30 days severity applies). For Ownership and Unknown Expiry, it’s the single severity you set in Step 3.

What does the Deduplication Window do? It suppresses repeat notifications for the same finding for N hours after the last one was sent. The finding itself still updates — only the email is held back. Set this higher (e.g. 72 hours) if recipients report alert fatigue.

Why can’t I delete a policy that has findings? Findings store the violation context and time series for audit. Deleting their parent policy would orphan the audit trail. Resolve or suppress the findings first, or just Disable the policy to stop generating new ones.

Can I have different severity for different asset types on the same policy? Not directly on a single policy. Create separate policies per asset type (or per group) and set severity on each.

---

Related

• Findings — what gets created when a policy matches
• Notifications — delivery tracking and policy-level routing
• Scan Management — when policy evaluation actually runs
• Asset Inventory — the assets policies evaluate against
• Setup Wizard — where the four wizard-seeded default policies come from
• Permission Sets — who can create and edit policies