Policies in YeshID [BETA]

Last updated: June 12, 2025

This feature is currently in BETA which means there may be some errors from time to time. Please let us know if you run into anything via our Community Slack (Or in comments below!)

Introduction

With YeshID, you can create policies to help take action when a specific CEL (Common Expression Language) expression is evaluated as true. Currently, the actions that are supported are the ability to send a Slack notification via the YeshID bot. Policies are evaluated periodically on every directory sync (Approximately once very 24 hours).

Think about the policies being the this in

If this (YeshID Policy), then that (Log an event, notify in Slack)

Components

Policies

A policy in YeshID is an object that's defined by CEL that when evaluated (every directory) as true, will create an event. These events can then be viewed, or set to send a Slack notification

SCR-20250611-keef-2.pngSCR-20250611-kemt.pngSCR-20250611-khus.png

Common Expression Language (CEL)

Policies are written in written in Google's Common Expression Language and the beauty of using it with YeshID comes from being able to query your IAM resources.

Do I need to know how to write CEL? Nope! With YeshID, you can use the prompt bar which will generate the CEL expressions under the hood.

Resources

You can use Yesh to create expressions with CEL to query your resources. Resources are what appears in this panel in YeshID. The resources currently supported are as follows.

A more detailed list (along with CEL schema) is provided below in Resources

SCR-20250611-kamc.png

Notifications

You can set-up your policies to notify a Slack channel when they are evaluated as true. See below.

Steps

Creating a Policy

  1. Navigate to Policies and click "Create"

  1. Type in your expression

    SCR-20250611-kntg.png

  2. Click "Create Policy"

SCR-20250611-kmii.png

  1. Set up Slack Notifications (OPTIONAL)

SCR-20250611-kncl.png

This requires that you have (1) connected the Slack application, and (2) that you have set up the YeshID Bot from Settings > Notifications.

A channel must have the YeshID bot invited to it before it can have slack notifications routed to it.

SCR-20250611-kmyc.png

What can I query?

  1. You can query any of the fields that show up for a resource

  • For example, the oAuth Applications resource returns the following:

    SCR-20250611-kkel.png

  • Based on this you can craft a query for anything that shows up in this table. For example:

    show me all applications that are associated with account_name carl@tstangerines.net

    SCR-20250611-kldg.png

    show me all the users associated with each application

    SCR-20250611-kktd.png

  1. You can also cross reference between resource types

    SCR-20250611-klpo.png

Resources

Resource

Field Name

Description

Possible Values / Type

Example CEL Match

current_time

(string)

The current time in RFC3339 format

e.g. "2024-06-11T12:34:56Z"

current_time > "2024-01-01T00:00:00Z"

people

id

User ID

UUID string

p.id == "user-uuid"

email

User email address

string

p.email.endsWith("@example.com")

first_name

User's first name

string

p.first_name == "Alice"

last_name

User's last name

string

p.last_name == "Smith"

is_admin

Whether user is an admin

bool

p.is_admin == true

status

User status

string (e.g. "active")

p.status == "active"

application_count

Number of provisioned applications for user

int

p.application_count > 2

google_users

id

Directory identity ID

UUID string

g.id == "dir-uuid"

first_name

First name

string

g.first_name == "Bob"

last_name

Last name

string

g.last_name == "Lee"

email

Primary email

string

g.email.endsWith("@company.com")

last_login

Last login timestamp (string)

string (RFC3339)

g.last_login < "2024-01-01T00:00:00Z"

mfa_enabled

MFA enabled

bool

g.mfa_enabled == false

is_mapped

Linked to a user

bool

g.is_mapped == false

user_id

Linked user ID

UUID string or null

g.user_id == null

is_super_admin

Is Google Super Admin

bool

g.is_super_admin == true

status

Directory identity status

string

g.status == "active"

org_unit

Organizational unit

string

g.org_unit == "/Engineering"

okta_users

id

Directory identity ID

UUID string

o.id == "dir-uuid"

first_name

First name

string

o.first_name == "Bob"

last_name

Last name

string

o.last_name == "Lee"

email

Primary email

string

o.email.endsWith("@company.com")

last_login

Last login timestamp (string)

string (RFC3339)

o.last_login < "2024-01-01T00:00:00Z"

is_mapped

Linked to a user

bool

o.is_mapped == false

user_id

Linked user ID

UUID string or null

o.user_id == null

status

Directory identity status

string

o.status == "active"

applications

id

Application ID

UUID string

a.id == "app-uuid"

name

Application name

string

a.name == "Salesforce"

hide_from_users

Hidden from users

bool

a.hide_from_users == false

is_integrated

Has active provisioning config

bool

a.is_integrated == true

has_integration_error

Provisioning config has error

bool

a.has_integration_error == false

oauth_applications

id

OAuth token ID

UUID string

oa.id == "oauth-uuid"

display_text

Display text

string

oa.display_text == "Google Drive"

client_id

OAuth client ID

string

oa.client_id == "abc123"

identity_email

Linked identity email

string

oa.identity_email.endsWith("@company.com")

identity_status

Linked identity status

string

oa.identity_status == "active"

first_seen

First seen timestamp (string)

string (RFC3339)

oa.first_seen > "2024-01-01T00:00:00Z"

is_forbidden

Is forbidden OAuth grant

bool

oa.is_forbidden == true

scopes

List of scopes

list of strings

'drive' in oa.scopes

application_accounts

id

Account ID

UUID string

aa.id == "account-uuid"

application_name

Application name

string

aa.application_name == "Salesforce"

account_name

Account name

string

aa.account_name == "jsmith"

external_id

External account ID

string

aa.external_id == "ext-123"

user_email

Linked user email

string

aa.user_email == "jsmith@example.com"

user_status

Linked user status

string

aa.user_status == "active"

license

License type

string

aa.license == "enterprise"

account_type

Account type

string

aa.account_type == "admin"

Recipes

Evaluate for:

  1. People with more than 3 apps:
    people.exists(p, p.application_count > 3)

  2. Google users without MFA:
    google_users.exists(g, !g.mfa_enabled)

  3. Applications with integration errors:
    applications.exists(a, a.has_integration_error)

  4. OAuth apps with forbidden grants:
    oauth_applications.exists(oa, oa.is_forbidden)

  5. Provisioned accounts for a specific app:

    application_accounts.exists(aa, aa.application_name == "Salesforce")