Overview
A Calculated Authorization Group is a group whose membership is determined automatically by a set of configurable rules rather than by manual assignment. Every night, the cron scheduler evaluates all active rule sets and adds or removes users accordingly.
Calculated groups are ideal for dynamic populations such as all users in department X or all users with contract type Y, where membership would otherwise need to be maintained manually.
Calculated vs. Explicit vs. Mix
| Type | How members join | Best for |
|---|---|---|
| Calculated | Automatically via rules (nightly cron) | Dynamic populations based on user attributes |
| Explicit | Manually by a responsible or delegate | Curated, stable lists |
| Mix | Combination of both | Mostly-automated with manual exceptions |
| Group of groups | Inherited from one or more child groups | Federated or nested access structures |
How rules work
Each Calculated group holds one or more rule sets. Each set contains one or more individual rules combined with a logic operator:
- OR — adds members (union): the rule set expands the population.
- AND — restricts members (intersection): the rule set narrows the population.
Rules can reference built-in system conditions (e.g. department, structure, contract type) or custom SQL conditions written by system administrators.
Force acquisition
Administrators can trigger an immediate recalculation without waiting for the nightly cron using the Force acquisition button in the group detail view.
Membership status badges
| Badge | Meaning |
|---|---|
| Calculated | User currently matches the active rules. |
| Calculated to acquire | User matches the rules but the explicit snapshot has not been taken yet. |
| Internal calc | Internally calculated — not yet synchronized to external provisioning systems. |
