Compliance Violation Indicator in Approval Workflows (4380676)

When a compliance rule is checked as part of a request approval workflow (CR – Compliance check, simplified), the violation result reflects the state of the request at the time of evaluation.

As a result, the following behavior may be observed:
    •    Requests continue to display Compliance violation in Request History, even after a conflicting request is denied.
    •    Approvers may see a Compliance violation flag although the Rule Violations view for the identity shows no active violations.
    •    In multi-level or custom approval workflows, later approvers may see a violation indicator that no longer reflects the current IS-state.

This behavior applies to both out-of-the-box and custom approval workflows.

This behavior is intentional and based on the following design principles:
    •    Compliance rules in approval workflows are evaluated point-in-time.
    •    The result of the compliance check is written to the order history.
    •    Order history entries are immutable and not recalculated.
    •    The Compliance violation label in request lists represents a historical evaluation result, not the current compliance status.

The Rule Violations view evaluates the current IS-state of the identity independently from request history.

Expected Behavior
    •    The Compliance violation label in Request History remains permanently, regardless of later approval or denial decisions.
    •    The Rule Violations tab reflects the current compliance status of the identity.
    •    Historical compliance indicators in request lists do not change.

This behavior ensures auditability and traceability of compliance-related approval decisions.

WORKAROUND:

If required, an administrator may manually recalculate the compliance rule:

• Within Manager navigate to Identity Audit
• Expand Rules and click on Enabled rules
• Click the Rule to be recalculated
• Click on the task "Recalculate rule"

There is no supported method to retroactively modify compliance indicators stored in request history.

STATUS:

•This behavior is standard in One Identity Manager 9.3.x
•For One Identity Manager 9.2.1, similar functionality is available via Change Request 461741
•Change Request 461741 was declined for 9.0 LTS.