Delinea AI - Iris Approver

This feature is not available in FedRAMP-compliant tenants.

This feature is currently available only to customers participating in a Private Preview. If you'd like to participate and be among the first to try this feature, ask our support or account team for details.

Iris Approver is an AI-driven access-approval agent that automates Secret Server approval workflows to streamline approvals, reduce unauthorized-access risk, and strengthen compliance with existing security policies.

Iris Approver evaluates each access request based on:

  • the requester's identity

  • the requester's stated intent

  • contextual risk signals

  • historical patterns

  • your organization's policies

To set up Iris Approver, see Configuring Iris Approver.

To view access requests processed by Iris Approver, see Viewing Access Requests.

Iris Approver vs. Manual Approval

Traditional manual access approvals can be time-consuming for both administrators and users. They are prone to human error and may not adequately assess the risk associated with each request.

Iris Approver addresses these challenges with automation based on comprehensive data, enhancing security and efficiency while still enabling human administrators to analyze approvals and intervene as necessary.

Iris Approver will not grant additional access beyond what is requested.

Recommend Mode vs. Decide Mode

Iris Approver operates in two primary modes: recommendation only and automated decision.

Mode Behavior
Decide Iris Approver automatically approves or denies the request based on predefined criteria.
Recommend Iris Approver recommends an action; a human approver receives the request and recommendation in the Inbox and approves or denies.

The process flows like this:

  1. Request Submission: A user submits an access request, including a ticket number and justification.

  2. Risk Assessment: Iris Approver evaluates the requester's risk level, access request duration, appropriateness of the stated reason, and other contextual signals.

  3. Ticket Verification: If configured in the profile's authorization checks, Iris Approver retrieves and analyzes the content of the associated ticket (from systems like Zendesk or ServiceNow).

  4. Decision Making: Based on the analysis, Iris Approver either approves or denies the request or presents an approve or deny recommendation to a human approver.

Decision Factors

When Iris Approver evaluates an access request, it considers the following (non-exhaustive) checks:

  • User risk level – Users rated Critical or High risk receive stricter scrutiny

  • User behavior – Deviations from the user's baseline, including:

    • Failed login attempts

    • Location anomalies

    • MFA use

  • Secret access request details – Properties of the request itself, including:

    • Justification is reasonable and professional

    • Duration is not excessive

  • ITSM ticket validation (if an ITSM connection is available)

    • Ticket number – Matches the ITSM ticket (e.g., Zendesk) with the access request

    • Ticket justification – Request reason must align with ticket description

Iris Approver Safety Statement

Human-AI Oversight Requirement

Iris Approver is designed to augment your skilled oversight – not to replace it. Iris Approver can be set either to alert you or to take pre-specified actions. This automation still requires a "human on the loop" for customer oversight, audit and feedback, to ensure accuracy and to optimize results over time. AI models are probabilistic in nature, meaning they can inherently produce outputs that are inaccurate or incomplete. You and your end users bear responsibility for any decisions, recommendations, actions, or inactions that arise from utilizing Iris Approver.

Data Privacy and Processing

Iris Approver uses the Azure OpenAI service provided by Microsoft. Key data handling and privacy features include the following:

  • Regional Data Hosting: Your tenant data is hosted and processed within the same region that you have selected for your cloud operation, ensuring compliance with regional data handling regulations.

Due to local data hosting requirements, Iris AI (Iris Approver and Auditing Powered by Iris AI) is not available in the United Arab Emirates.

  • Data Deletion After Processing: When Azure OpenAI finishes processing data from a Delinea Platform access request, the data is immediately deleted from Azure and not retained by Microsoft. This ensures that evaluation data is handled securely and transiently.

  • No AI Training with Customer Data: Iris Approver does not and will not use customer recordings or data to train AI models unless we obtain your specific prior written authorization to do so.

Enabling the AI Agreement

In addition to enabling the Iris Approver capability, an administrator must approve the AI Agreement before Iris Approver can begin reviewing access requests.

For steps to enable Iris Approver and accept the agreement, see Configuring Iris Approver.