1What a collection is
The unit of access assignment in EmpowerNow
A collection is a named group of people (or other subjects). Access is never assigned directly to an individual — instead, you assign a collection to an application role. Every member of the collection inherits that role automatically.
This makes access management scalable: instead of managing 500 individual role grants, you manage one collection with 500 members and one assignment to the Engineering role.
| Collection type | Membership is managed by | Best for |
|---|---|---|
| Static | Admins manually adding/removing people | Small, curated groups (e.g. "Executive Team", "Contractors") |
| Dynamic | Attribute-based rules evaluated automatically | Department-based or role-based cohorts that change with HR data |
| Rules-based (hybrid) | Rules + manual overrides | Core dynamic membership with specific exceptions pinned manually |
Claim-Role Mapping rules add users to collections at federated login. This means you can combine dynamic membership (HR rules) with federation-based membership (CRM) in the same collection — users appear when they match any path.
2Open Collections list
Administration → Identity → Collections
Navigate to /collections-admin/collections. The list shows all collections with key metadata. The Open in Collections Admin button in the header opens the full collections admin panel for advanced management (deputies, governance templates, evidence policies).
| Name | Kind | Members | Visibility | Last Modified | Actions |
|---|---|---|---|---|---|
| Engineering | ⚡ Dynamic | 142 | ● Published | 2h ago | View |
| HR Team | 📌 Static | 18 | ○ Private | 3d ago | View |
| Contractors Q2 | 📌 Static | 7 | ○ Private | 1w ago | View |
3Create a collection
Click + New Collection to open the creation modal
| Field | Notes |
|---|---|
| Name | Must be unique. Used in access assignments, CRM rules, and audit logs. Use clear, descriptive names. |
| Kind | Static: manual only. Dynamic: rule-based auto-membership. Rules-based: rules + manual overrides. |
| Visibility | Private: only admins can see and use. Published: appears in the self-service access request catalog. |
4Collection detail tabs
Click a collection name to open its detail page
| Tab | What you see & do |
|---|---|
| Overview | Name, description, kind, member count, visibility, created date. Quick action buttons: Edit, Archive, Delete. |
| Members | All current members with their join date and join method (manual/rule/CRM). Add Member and Remove buttons per row. Bulk actions available. |
| Rules | Attribute-based rules for dynamic membership. Add, edit, or remove rules. "Run Rules Now" button to force immediate re-evaluation. |
| Policies | Governance policies attached to this collection — e.g. certification schedule, access review frequency, risk level. |
| Evidence | Audit trail of all membership changes: who was added/removed, when, by whom or which rule. |
| Permissions | Collection deputies — other users who can manage this collection without full admin access. |
5Add members manually
Click + Add Members on the Members tab
A member search modal opens. Type a name or email to find people. Check the boxes next to the people you want to add and click Add X Members. The people appear in the member list immediately with join method "manual".
You can manually add someone to a Dynamic collection even if they don't match the rules. They are added as "pinned" members and won't be removed when rules run. Use this for exceptions — for example, a contractor who needs Engineering access but has a different department attribute.
To remove a member: find them in the Members tab and click Remove. For pinned manual members in Dynamic collections, removing them permanently excludes them unless they later match a rule.
6Define membership rules
Rules determine who automatically belongs to a Dynamic collection
On the Rules tab, click + Add Rule. Each rule has an attribute (e.g. department, jobTitle, email), an operator (equals, contains, starts with, is in list), and a value.
| Rule component | Notes |
|---|---|
| Attribute | Any person attribute: department, jobTitle, email, status, custom attributes. Must exactly match the attribute key name. |
| Operator | equals, not equals, contains, starts with, ends with, is in list, exists, not exists |
| Value | The expected value. For "is in list", comma-separate values: Engineering,DevOps,Platform |
Multiple rules: Within a single rule, conditions use AND logic. Between rules, they use OR logic — a person is added if they match any rule.
Force immediate membership re-evaluation
After adding or changing rules, click Run Rules Now on the Rules tab. This immediately re-evaluates all people against the current rule set. People who now match are added; people who no longer match are removed (unless manually pinned).
Making a rule more restrictive (e.g. changing from "department contains 'Eng'" to "department equals 'Engineering'") can remove existing members whose attributes don't exactly match. Review the current member list before running rules after a change.
7Publish for self-service
Published collections appear in the access request catalog
When a collection's visibility is Published, end users can discover it in the IT Shop / access request portal. They can request membership, which enters a configured approval workflow. This is the mechanism for self-service access requests in EmpowerNow.
To publish: go to the collection's Overview tab and click Publish Collection. The visibility badge changes to Published. To unpublish: click Make Private. Unpublishing does not remove existing members.
Before publishing, configure the access request workflow in the Policies tab. Without a workflow, requests may auto-approve. At minimum, set an approver or approval group for the collection.
8Archive or delete
Archive preserves data while removing the collection from active use
Archived collections are not available for new access assignments, do not appear in the self-service catalog, and do not receive membership updates. However, all member history, evidence, and audit data is preserved for compliance purposes. Archived collections can be restored.
To archive: Overview tab → Archive Collection.
Delete permanently removes the collection
Deletion requires all members to be removed first. To delete: remove all members from the Members tab, then click Delete Collection on the Overview tab. A confirmation dialog names the collection. Type the collection name to confirm.
If the collection has active access assignments (linking it to application roles), deleting the collection will leave those assignments orphaned. Navigate to the Access Assignments Workbench and remove assignments for this collection before deleting it.