docs: hold policy-references content until broader GA

product/admin/policies.mdx

@@ -66,6 +66,24 @@
 
 Each of these is created as a step in a policy rule. 
 
+### Use a policy within a rule
+
+A policy rule's outcome, or a policy's baseline, can point to another policy instead of listing out its own steps. Build a common flow once, like a security review or a manager-then-owner approval chain, and use it from every policy that needs it. Update the policy you're pointing to, and every policy that uses it picks up the change on its next request — no hunting down copies.
+
+For example, a rule could say: "If the requester is in Engineering, use the Security review policy. Otherwise, use the Standard approval policy."
+
+To point a rule or the baseline at another policy, select **Use a policy** as the action, then choose the policy.
+
+<Note>
+A policy you point to must be the same type (request, review, or revoke) as the policy pointing to it. You can chain up to five policies deep, and C1 rejects cycles or self-references when you save.
+</Note>
+
+A few things to know about how this behaves:
+
+- **The policy locks in when a task is created.** C1 resolves the full chain at that point and snapshots it onto the task, so editing a policy you point to only affects future requests, not tasks already in progress.
+- **You can see the routing.** A task's audit log shows which policy each step came from, and where a matching rule sent the request.
+- **You can't delete a policy that's in use.** If another policy points to it, C1 blocks the deletion and names the policy that's still pointing to it.
+
 ## Get agent help building policies
 
 <Warning>
@@ -117,7 +135,7 @@
 
    - Use the **Basic** condition builder to construct a rule from a combination of entitlements and [profile attributes](/product/admin/attributes) (see note below on which profile attributes are supported), with the option to add **and** and **or** statements to refine the rule.
    <Tip>
    **Supported attributes in the basic condition builder** The value input field in the basic condition builder currently only supports string values. Certain attributes are stored as enums (fixed lists of values) or arrays (multiple values), which cannot be correctly parsed when entered as a simple string in the basic builder. If you use these attributes in the basic builder, the system will treat the input as a literal string, and the policy or membership rule may not behave as expected.
 
    The following attributes are not supported in the basic condition builder:
 
@@ -129,10 +147,10 @@
 
    If you need to use any of the attributes listed above, you must compose a CEL expression in the **Expression** field.
    </Tip>
    - Use the **Expression** field to to compose a [CEL expression](/product/admin/expressions) that describes the membership rule.
 </Step>
 <Step>
-In the **Then perform this action:** section of the rule, select an automatic action (the exact actions vary by policy type) or **Execute a workflow** to wait for a condition to be met or assign the task to a reviewer workflow (see below).
+In the **Then perform this action:** section of the rule, select an automatic action (the exact actions vary by policy type), **Execute a workflow** to wait for a condition to be met or assign the task to a reviewer workflow (see below), or **Use a policy** to [point this rule at another policy](/product/admin/policies#use-a-policy-within-a-rule) instead of building steps inline.
 
    If necessary, click **Add step** to add additional actions or workflows to the rule.
 </Step>
@@ -142,7 +160,7 @@
    Remember, for best results place more specific rules before less specific rules.
 </Step>
 <Step>
-Edit the [baseline rule](/product/admin/policies#the-baseline-rule). The baseline rule can be set to take an automatic action (the exact actions vary by policy type), or to assign the task to reviewers, as described below.
+Edit the [baseline rule](/product/admin/policies#the-baseline-rule). The baseline rule can be set to take an automatic action (the exact actions vary by policy type), assign the task to reviewers as described below, or [use a policy](/product/admin/policies#use-a-policy-within-a-rule) to point it at another policy.
 </Step>
 <Step>
 Click **Save**.
@@ -244,7 +262,7 @@
 
 3. Set whether the reviewer (or the fallback reviewer, if applicable) can reassign the task, and whether reassigned tasks require a reason for their reassignment.
 
    Use the **Limit reassignment to** field to create an allowlist of users who the task can be reassigned to. If the task can be reassigned to any user, leave this field blank. 
 
 3. Set whether this step allows the task to be reassigned to an assigned delegate, either a [delegate set by an admin](/product/admin/delegate#set-a-delegate-for-another-user), such as for an executive or employee out on long-term leave, or a [delegate set by an individual user](/product/admin/delegate#set-your-own-delegate) while they are out of office.  
 
@@ -252,11 +270,11 @@
 
 4. **Request and review policies only.** Set whether this step requires a distinct approver. This means a user who approved an earlier step in the workflow cannot approve this step, ensuring a different set of eyes reviews each stage.
 
    If **Require distinct approvers** is enabled, the system automatically assigns the task to an approver who has not previously approved the request. If the policy can't find a distinct approver, it will automatically route the approval to fallback users (Campaign Admins or Super Admins).
 
 5. Set whether approvals and denials require the reviewer to enter a justification for their choice.
 
 6. **Optional.** If desired, check to enable **Trigger SLA violation after** and set the timeframe for a service-level agreement (SLA) to kick in. If no action has been taken on the task when the time elapses, select what happens next:
 
    * **Use a new policy** - Select a different policy from the list to take over the approval process.
 

product/glossary.mdx

@@ -11,7 +11,7 @@
 An access conflict occurs when two entitlements assigned to the same user violate a separation of duties (SoD) policy or other regulation. See [Conflict monitor](/product/glossary#conflict-monitor). 
 
 #### Access profile
 A group of resources and entitlements curated for their applicability to a certain audience and only visible to that audience. Access profiles limit what resources and entitlements each user can see and request, so only relevant access is visible and available. An access profile can be set up so that users can request each app or permission it contains individually (in their app catalog), or so that the entire bundle of access is requestable as a unit (also called a profile). See [App catalog](/product/glossary#app-catalog). 
 
 #### Account
 A unique record associated with a specific actor (such as a human, a system account, or a service account) within an application. An account in an application is granted permissions and roles in that app. 
@@ -32,7 +32,7 @@
 A custom risk level or compliance framework tag that you create and apply to entitlements, such as “SOC2” or “High risk”. 
 
 #### Automation
 A custom workflow built in C1 that automates repetitive tasks such as onboarding, offboarding, and role transfers. An automation consists of a trigger (the event or schedule that causes it to run) and one or more steps (the actions it performs). Automations can run automatically based on their trigger or be started manually on demand. See [Task](/product/glossary#task) and [Policy](/product/glossary#policy).
 
 #### Baton
 The open-source code framework that powers connectors. Named for an orchestra conductor’s baton, which focuses and directs the musicians, and for the baton transferred from one runner to the next (like data!) in a relay race. We like a double meaning around here. 
@@ -47,7 +47,7 @@
 C1 groups are collections of C1 users that you create and use within C1. They can be useful for organizing groups of employees as access recipients or assignees to tasks.
 
 #### Campaign (UAR)
 User access review (UAR) campaigns are a framework for periodically reviewing user access. A campaign has a scope (the access to be reviewed) and a timeframe (the start and end dates of the campaign). 
 
 #### CEL
 Common Expression Language (CEL) was developed by Google and is used in C1 to write conditional expressions that use variables and user data known to C1. 
@@ -68,10 +68,10 @@
 The open, OAuth-based protocol that [enterprise-managed authorization](/product/glossary#enterprise-managed-authorization-ema) is built on. No single vendor owns it; any provider can implement it, and C1 does. Under XAA, C1 exchanges a signed-in user's identity for a short-lived, scoped token (an [ID-JAG](/product/glossary#id-jag)) addressed to a specific MCP server, after checking the user's entitlements; the agent then calls the server directly, so C1 is not in the data path. See [Enterprise-managed authorization overview](/product/admin/enterprise-managed-authorization/overview).
 
 #### Custom form
 Additional fields added to an access request that require requestors to provide context when making a request, such as a cost center code, ticket reference, or start date. Custom forms help IT and security teams make informed approval decisions and support audit and compliance requirements. See [Request](/product/glossary#request).
 
 #### Deprovision
 The process of removing previously assigned permissions or shutting down user accounts in connected systems after a revocation proposal is confirmed. In C1, deprovisioning tasks are assigned to users when manual deprovisioning of access is required. See [Revoke / Revocation](/product/glossary#revoke-/-revocation). 
 
 #### Digest
 A personalized email sent to C1 users that includes an overview of open tasks, connector sync errors, expiring access, and more. Sometimes called “daily digest”, but can be set by your organization for daily or weekly delivery. 
@@ -98,10 +98,10 @@
 Identity risk data from external security tools — such as risk scores and security findings — that C1 syncs and surfaces alongside the identities it describes. External insights are shown during access reviews and at the moment of approval so reviewers can make more informed decisions without switching tools. 
 
 #### External ticketing system
 An integration with your organization’s IT ticketing system, such as Jira or ServiceNow. Once configured, when manual provisioning of new access is required, C1 automatically creates a ticket in the connected external ticketing system. C1 will monitor the status of the ticket and mark the provisioning step complete in C1 once the ticket is closed. 
 
 #### Function
 Serverless TypeScript functions that extend C1's capabilities with custom automation logic. Functions can call external systems, run on events, implement organization-specific workflows, and access C1 data through the C1 SDK. A function can be invoked from an automation step, the C1 web UI, or the API.
 
 #### Grant
 A record indicating that an application account has been explicitly assigned an entitlement on a resource. See [Entitlement](/product/glossary#entitlement) and [Account](/product/glossary#account).
@@ -113,7 +113,7 @@
 An existing relationship between an entitlement in an IdP and one in a standalone application. Linked entitlements commonly connect IdP resources with the apps the IdP controls access to. 
 
 #### Managed app
 An application that you’re actively managing with C1. A managed application has an active connector or other data source. See [Application](/product/glossary#application), [Connector](/product/glossary#connector), and “Unmanaged app”. 
 
 #### Mapping
 The process of matching how key data points are labeled in an integrated software or service with how they’re labeled in C1, so data can be pulled in and used correctly across sources. 
@@ -122,10 +122,13 @@
 A server an AI agent connects to over the Model Context Protocol (MCP) to call tools and reach data. Under [enterprise-managed authorization](/product/glossary#enterprise-managed-authorization-ema), C1 issues a scoped, short-lived token addressed to a specific MCP server. In the underlying [Cross-App Access](/product/glossary#cross-app-access-xaa) protocol, the MCP server is the "resource server."
 
 #### Membership
 A rule set on an access profile that automatically creates enrollment or unenrollment requests for users who meet — or no longer meet — defined criteria such as department, job title, or manager. Membership automates access changes when users join, leave, or move between teams without requiring manual requests. See [Access profile](/product/glossary#access-profile) and [Enrollment](/product/glossary#enrollment).
 
 #### Policy
-A reusable rule set that defines a process for requesting, reviewing, or revoking access. Policies can contain instructions such as who a certain task should be routed to, as well as instructions on sending notifications, triggering webhooks, conditional routing, and much more. 
+A reusable rule set that defines a process for requesting, reviewing, or revoking access. Policies can contain instructions such as who a certain task should be routed to, as well as instructions on sending notifications, triggering webhooks, conditional routing, and much more. See [Policy reference](/product/glossary#policy-reference).
+
+#### Policy reference
+A policy rule or baseline set to the **Use a policy** action, which points to another policy of the same type instead of defining its own steps. Policy references let a common flow, such as a security review or an approval chain, be reused across every policy that needs it. See [Policy](/product/glossary#policy) and [Task](/product/glossary#task).
 
 #### Profile attribute
 A piece of information about an application account that is pulled in from an application, and that can be used to scope UAR campaigns or build policies. See [Account](/product/glossary#account). 
@@ -139,10 +142,10 @@
 #### Request
 Broadly, when a user asks for a new permission, this is a request (or more formally, an access request). In C1, the user submits the request and a request task is created, which is governed by a request policy. See [Task](/product/glossary#task) and [Policy](/product/glossary#policy). 
 
 #### Requestable action
 An automation exposed to end users as a requestable object, allowing them to trigger a workflow — such as requesting temporary elevated access or initiating an offboarding task — through a standard approval process rather than requiring standing permissions. See [Automation](/product/glossary#automation) and [App catalog](/product/glossary#app-catalog).
 
 #### Requestor
 The person making a request for access. This is most commonly the user who will be granted the access, but it can be a manager or other admin making the request on the user’s behalf. 
 
 #### Resource
@@ -179,7 +182,7 @@
 Shadow apps are applications and cloud services not managed or approved by an organization’s IT department that employees sign into using their corporate email. 
 
 #### Step-up authentication
 An additional authentication challenge required of approvers before they can approve sensitive access requests. C1 implements step-up authentication using the RFC 9470 OAuth 2.0 Step Up Authentication Challenge Protocol, generating a fresh challenge for each qualifying approval so that prior authentication state is never reused. See [Policy](/product/glossary#policy) and [Request](/product/glossary#request).
 
 #### Sync
 The process of reaching out to an integrated software tool or service via a connector to read new data or to write data to the tool or service based on changes and decisions made in C1. Based on the type and configuration of the connector, syncs can happen automatically on a schedule, or can be triggered manually. See [Connector](/product/glossary#connector). 
@@ -193,7 +196,7 @@
 #### Template
 A pre-configured, reusable framework for creating recurring UAR campaigns. Templates make it faster and easier to set up identical or very similar campaign configurations when you need to run a certain campaign on a recurring schedule. 
 
 #### Unmanaged app
 The child apps that are discovered by a connector for an app that is an identity provider (IdP), SSO, or federation provider, but that you haven’t yet added a connector or other data source to so you can begin managing them in C1. See [Managed app](/product/glossary#managed-app). 
 
 #### User
@@ -212,6 +215,6 @@
 A special proxy entitlement that is created in C1 and does not get written back to the source software. Virtual entitlements are ideal for making easy-to-understand user-facing target entitlements that can be bound to more complex existing entitlements in your IdP, SSO, or federation provider. 
 
 #### Webhook
 An HTTP callback that connects C1 to external systems. Outbound webhooks fire from C1 to an external URL when certain events occur, such as when a provisioning step completes. Inbound webhooks allow external systems to trigger C1 automations by sending authenticated HTTP POST requests to a C1 listener endpoint. 
 
 

product/release-notes.mdx

@@ -16,23 +16,29 @@
 
 Revoking one path to an entitlement — such as a direct grant — can leave the user with equivalent access through another, such as a group or role they also belong to. In these cases, the next sync often resurrects the grant, because group membership was never removed at the connector. The revocation task was complete, but the access never actually went away.
 
-Smart revocation traces where an entitlement's access really comes from and revokes upstream sources too, not just the entitlement itself. Turn on **Revoke inherited access** and a revoke on that app follows the chain — direct grants, nested groups, role hierarchies, delegated provisioning — instead of stopping at the first result. It's off by default and set per app; a banner shows the downstream effects before an approver commits, so nothing gets revoked as a surprise. [Learn more.](/product/admin/access-requests#automatically-revoke-inherited-access)
+Smart revocation traces where an entitlement's access really comes from and revokes upstream sources too, not just the entitlement itself. Turn on **Revoke inherited access** and a revoke on that app follows the chain — direct grants, nested groups, role hierarchies, delegated provisioning — instead of stopping at the first result. It's off by default and set per app; a banner shows the downstream effects before an approver commits, so nothing gets revoked as a surprise. [Set up automatic revocation of inherited access.](/product/admin/access-requests#automatically-revoke-inherited-access)
 
-{/* REMOVED (2026-08-24): "Policy improvements" section — both items were SKU_MANUAL / not broadly available.
-   - "Create local policies for special use cases" (PR #22917): gated behind LOCAL_POLICIES, SKU_MANUAL on origin/main.
-   - "Reuse a policy instead of copying it" (PR #22677): gated behind POLICY_REFERENCES_POLICY. Initially marked "Confirmed GA" in error; developer confirmed on 2026-08-24 it's enabled for one customer only, not broadly available. The writeup and its policies.mdx/glossary.mdx docs (PR #455, reverted from main) are held on branch hold/policy-references-ga (PR #506) pending real GA. */}
+### Reuse a policy instead of copying it
+
+{/* Held pending broader GA — see PR #506. Enabled for one customer only as of 2026-08-24; POLICY_REFERENCES_POLICY is SKU_MANUAL. Do not merge into main until the developer confirms wider rollout. */}
+
+A policy rule's outcome, or a policy's baseline, can now point to another policy instead of listing out its own steps. Build a common flow once — like a security review or a manager-then-owner approval chain — and use it from every policy that needs it. Update the policy you're pointing to, and every policy that uses it picks up the change on its next request, so you're not hunting down and updating copies scattered across your policy library.
+
+To point a rule or the baseline at another policy, select **Use a policy** as the action, then choose the policy. A policy you point to must be the same type (request, review, or revoke) as the policy pointing to it — you can chain up to five policies deep, and C1 rejects cycles or self-references when you save. [Use a policy within a rule.](/product/admin/policies#use-a-policy-within-a-rule)
+
+{/* PR #22677 */}
 
 ### Access review and request improvements
 
-- **Add context for campaign reviewers**: Reviewer-visible app user attributes (job title, department, cost center) previously only showed up in a hover tooltip, so reviewers had to mouse over every row to get them. Campaign admins can now configure any of these as their own column in the access review table — up to 10 per campaign. This option only appears once the campaign's **Default access review view** is set to something other than **None**. [Learn more.](/product/admin/campaigns#step-2-configure-how-the-campaign-will-run)
+- **Add context for campaign reviewers**: Reviewer-visible app user attributes (job title, department, cost center) previously only showed up in a hover tooltip, so reviewers had to mouse over every row to get them. Campaign admins can now configure any of these as their own column in the access review table — up to 10 per campaign. This option only appears once the campaign's **Default access review view** is set to something other than **None**. [Configure review columns for a campaign.](/product/admin/campaigns#step-2-configure-how-the-campaign-will-run)
 
 - **Any reviewer can inspect what they're reviewing**: Previously, only users with appropriate permissions could click into the entitlement or resource under review from the review task; now any assigned reviewer can open a read-only details drawer without leaving the page.
 
 - **See revoke work at a glance**: An app's **Requests** tab can now be filtered to show **Request** or **Revoke** tasks, and the "Open revocations" stat card on the app's **Overview** tab links straight to that filtered view.
 
 ### Automation improvements
 
-- **Scope automated revokes to the grants you actually mean**: An automation's revoke step always removed both a user's direct grants and anything they had through group membership, so automating cleanup of direct access meant accepting collateral revocation of group-inherited access too. Revoke steps now have a **Grant source** setting (**All** or **Direct**) to scope a revoke to only direct grants. [Learn more.](/product/admin/automations-steps-reference#revoke-entitlements)
+- **Scope automated revokes to the grants you actually mean**: An automation's revoke step always removed both a user's direct grants and anything they had through group membership, so automating cleanup of direct access meant accepting collateral revocation of group-inherited access too. Revoke steps now have a **Grant source** setting (**All** or **Direct**) to scope a revoke to only direct grants. [Set the grant source on a revoke step.](/product/admin/automations-steps-reference#revoke-entitlements)
 
 - **Circuit-breaker logs now play nice with your SIEM**: Automation circuit-breaker system-log events include the standard OCSF time field, so you no longer need a workaround to parse them into your SIEM.
 
@@ -1189,7 +1195,7 @@
 
 * **Reviewer performance:** Track reviewer decision rates and average review time. See who's holding up the queue and remind them to finish their reviews.
 * **Progress by app:** Gain clarity by precisely tracking review completion status broken down by application.
 * **Workflow visualization:** A campaign burndown chart lets you visualize the campaign's remaining open reviews over time.
 
 You'll find the updated dashboard on every running and completed campaign.
 
@@ -1213,7 +1219,7 @@
 
 C1 now supports custom user avatars! To change your own user avatar, open your profile menu in the upper right corner of the screen, click your name, then click the edit icon on your current avatar image. 
 
 Not content just updating your own avatar? On on the user details pages, managers can also upload avatars for their direct reports, and Super Admins can upload avatars for any user.  
 
 ### New bulk actions 
 
@@ -1241,7 +1247,7 @@
 
 * To make it easier for users to understand exactly what they're reviewing in a campaign, the by-user reviews view now shows the exact entitlement under review instead of the parent resource. 
 
 * We've consolidated entitlement provisioning and deprovisioning settings into a single new **Access management** section on an entitlement's details page. 
 
 * When clicking to the next or previous page of a table, the view now automatically scrolls to the top, improving the navigation experience.
 
@@ -1281,13 +1287,13 @@
 
 * We've added a new query to the **Access explorer** page: **Active external accounts**. This list can be downloaded as a CSV for easy sharing and analysis.
 
 * You can now create fine-grained revoke entitlement steps in your automations. Use criteria such as the entitlement risk level or compliance framework to zero in on which entitlements to revoke or to exclude from revocation. 
 
 * The task report you can generate and download on the **Task log** page now includes details on who approved each task and the approver's email address, making it easier to track and audit approval workflows.
 
 * When creating [attribute mappings](/product/admin/attributes) in the new directory UI, you can use a mix of direct mappings and CEL expressions for each source. This allows you to set up complex fallback logic, which is especially useful for attributes that accept multiple values, such as Additional Usernames.
 
 * You can now configure the deprovisioning process to be used for an entitlement on the entitlement's details page, providing more granular control over resource clean-up. 
 
 * The Microsoft Teams app now sends notifications to the relevant admins when a connector experiences a sync error or detects an anomaly in the synced data.
 
@@ -1351,7 +1357,7 @@
 
 ### Usability updates 
 
 * You can now require that a different user approves each step in request and review policies. Enable **Require distinct approvers** on a step to prevent users who approved previous steps from approving the current one.  For full details, visit the docs on [Policies](/product/admin/policies). 
 
 * Need a report of all the access granted to a certain application account? You can now create and download one by navigating to **Requests** > **Accounts** > **View access** and clicking the **Generate CSV** button. 
 
@@ -1422,7 +1428,7 @@
 
 * We fixed issues that were preventing users with either the **Connector Administrator** user role or both the **Read-Only Admin** and **Basic User** user roles from completing their assigned tasks. 
 </Update>
 <Update label="October 3, 2025">
 
 ### Usability updates
 
@@ -1446,7 +1452,7 @@
 
 ### Fixed! 
 
 * When a limited-duration grant has expired, it is now shown on the user's **App catalog** page as requestable, rather than granted. 
 </Update>
 <Update label="September 19, 2025">
 
@@ -1504,13 +1510,13 @@
 
 ### Fixed! 
 
 * We fixed the names of the bulk actions used for marking multiple grants deprovisioned. 
 </Update>
 <Update label="August 29, 2025">
 
 ### System management controls
 
 On the new **System management** page in the **Settings** section, we've added controls that allow Super Admins to disable all Slack and email notifications, access profile membership automations, and automations for your C1 tenant. 
 
 Use one or all of these controls when a temporary pause in regular C1 operations is necessary for testing, to prevent unintended consequences, or to perform critical maintenance. Check out [Temporarily disable system features](/product/admin/global-settings#temporarily-disable-system-features) for all the details. 
 
@@ -1528,7 +1534,7 @@
 
 ### Request forms 
 
 If you need requestors to answer questions or provide additional information when requesting certain entitlements, you can now create custom request forms that gather this data. Build request forms to gather precisely the information you need, and set them on one or many entitlements. Check out [Collect additional information from requestors using request forms](/product/admin/customize-requests#collect-additional-information-from-requestors-using-request-forms) to learn more and get started. 
 
 ### Automations updates 
 
@@ -1552,7 +1558,7 @@
 
 * Good news for anyone heading out on vacation this month: When [setting your own out-of-office delegate](/product/admin/delegate#set-your-own-delegate) you can now select a **Permanent** (ongoing) delegate or a **Temporary** delegate with specified start and end dates for the delegation period. 
 
 * Assigned access request approvers and users with the **Super Admin** user role can now change the duration of a requested grant before approving the request. The change in duration will be noted in the task's audit log. 
 
   <Frame>
   <img src="/images/product/assets/release-notes-15-aug-25.png" alt="A screenshot of a request task in the C1 UI, showing the duration field in its active edit state."/>
@@ -1614,11 +1620,11 @@
 
 We're in the process of upgrading our older connectors from [v1 to v2](/baton/migration) to improve performance and enable long-term support. While your existing v1 connectors might be marked as deprecated, they are still supported. No action is needed at this time unless you encounter a non-critical issue, in which case we may guide you to migrate. 
 
 ### Unused access automations
 
 The new **Unused access** section on each app's details page lets you see and manage app accounts that have not been used recently, and that might be good candidates for revocation. Click **Account unused > 30 days** to view the list of accounts in that state. 
 
 You can also set up tailored unused access automations from this section to notify, revoke, or perform the actions of your choice when access is not used within a specified timeframe. Go to [Unused access automations](/product/admin/automations#unused-access-automations) to learn more. 
 
 ### Usability updates 
 
@@ -1640,7 +1646,7 @@
 
 * The edit button for an application's description is now visible even when the description is extremely long. 
 
 * When automatically deprovisioning an account, all steps in the policy are performed. 
 
 * Clicking **Next user** in a by-user campaign correctly loads the next set of reviews.
 </Update>
@@ -1650,11 +1656,11 @@
 
 * We've added a new automation step option: **Grant entitlements**. Use an automation to grant a user one or more entitlements when the automation's conditions are met. 
 
 * App-specific automations can be created and managed by application owners who also have the **App Admin** user role. You can create, view, and manage these automations on the application page's **Automations** tab. Go to [App-specific automations](/product/admin/automations#app-specific-automations) to learn more. 
 
 ### Usability improvements
 
 * On the **Applications** page's **Unmanaged apps** tab, we've made two key improvements: 
 
   * Use the new **Parent app** filter to show only the child apps of a particular IdP, SSO, or federation provider. 
 
@@ -1664,19 +1670,19 @@
 </Update>
 <Update label="July 11, 2025">
 
 ### Introducing automations 
 
 We're thrilled to introduce [automations](/product/admin/automations), a powerful new feature designed to dramatically streamline your operational processes within C1. Build custom workflows to handle repetitive tasks, reduce manual effort, improve compliance, and achieve greater efficiency. 
 
 Automations are ideal for:
 
 * Kicking off critical processes based on employee status changes
 * Providing seamless onboarding experiences
 * Ensuring secure and efficient offboarding
 * Managing role transfers with ease
 * Automating timely access reviews
 
 Explore these new capabilities on the **Automations** page!
 
 ### Inventory page 
 
@@ -1700,9 +1706,9 @@
 
 * When you replace a file, you'll now see information on the name of the previously uploaded file and the date when it was uploaded.  
 
 ### camelCase CEL expressions
 
 We are adopting camelCase for all [CEL expressions](/product/admin/expressions), and moving away from snake_case. This change will make writing and reading CEL expressions in C1 more consistent, and is intended to improve the overall developer experience. You don't need to modify any expressions you're using today, but new expressions should be written in camelCase. 
 </Update>
 <Update label="June 27, 2025">
 
@@ -1720,9 +1726,9 @@
 </Update>
 <Update label="June 20, 2025">
 
 ### App account deprovisioning
 
 By default, C1 automatically sets the account deprovisioning process based on your app's provisioning configuration. To customize deprovisioning, go to the app's **Controls** tab and [set how app accounts are deprovisioned](/product/admin/access-requests#set-how-app-accounts-are-deprovisioned).
 
 ### Usability improvements
 
@@ -1764,7 +1770,7 @@
 
 ### Streamline access request configuration
 
 The new [standard audience](/product/admin/access-requests#set-the-standard-audience-for-an-app-and-select-requestable-entitlements) setting on an application lets Application Admins and Super Admins quickly make specific entitlements within the application requestable to everyone in your organization or to select groups, without the need to set up an access profile. 
 
 ### Usability improvements
 
@@ -1782,7 +1788,7 @@
 
 ### Fixed!
 
 * The names of unmanaged apps are now automatically updated when the corresponding apps' names change in the IdP. 
 
 * Deleted access profiles are no longer included in the access summaries shown on an app's **Entitlements** tab. 
 
@@ -1807,7 +1813,7 @@
 
 * The full list of an app's linked entitlements is shown, instead of only the first 50. 
 
 * You can now successfully delete steps in an account provisioning or deprovisioning configuration. 
 
 </Update>
 <Update label="May 23, 2025">
@@ -1844,9 +1850,9 @@
 
 ### Usability improvements 
 
 * You can now set a SLA (service-level agreement) fallback step on a policy. If no action has been taken on a task step when the SLA timeframe you set elapses, the task can be automatically redirected to use a new policy or reassigned to a different user. 
 
 * On an application's **Entitlements** tab, access controls information is now shown in the **Requests** column, where you'll find a tooltip with info on which access profiles each entitlement is part of.
 
 ### Fixed! 
 
@@ -1871,11 +1877,11 @@
 
 * New this week: [Microsoft Azure DevOps](/baton/azure-devops) and [Workday Account (WQL)](/baton/workday-wql). 
 
 * The new [Zendesk v2](/baton/zendesk) connector adds support for syncing roles and provisioning roles, orgs, and groups. Learn more about [connector versions and migration](/baton/migration). 
 
 * You can now specify which [user attributes](/product/admin/attributes) a connector syncs to C1. Go to [Select which attributes a connector syncs](/baton/configure) to get started.
 
 * A new configuration field on the [Snyk](/baton/snyk) connector adds support for users who use regional hostnames other than `api.snyk.io`.  
 
 * We've added a configuration field to the [Okta AWS Federation](/baton/okta-aws-federation) connector that opts into the conversion of user assignments to direct assignments. 
 
@@ -1913,9 +1919,9 @@
 
 * The Greenhouse connector now supports account provisioning. You can also use the connector to revoke Site Admin user permissions from accounts. We've added a new configuration field to support this feature. Check out the [Greenhouse connector docs](/baton/greenhouse) to learn more.   
 
 * The Grafana connector now supports organization provisioning. 
 
 * The Asana connector now syncs licenses and supports license provisioning. We've added a new configuration field to support these capabilities. Check out the [Asana connector docs](/baton/asana) to learn more.   
 
 ### Usability improvements 
 
@@ -1959,13 +1965,13 @@
 
 * If a connector has failed three syncs following a successful sync, the connector owner (or the application owner if a connector owner is not set) will receive a email notification about the connector sync error. 
 
 * The Grafana connector now supports account provisioning. 
 
 * The Asana connector now supports account provisioning and has a new configuration option to add the ID of the workspace where newly created accounts should be added. 
 
 * The Incident.io connector now syncs basic and custom roles. 
 
 * To improve performance, the Okta-AWS Federation connector now requires that identities be pulled from an Okta connector. See the [Okta AWS Federation connector docs](/baton/okta-aws-federation) for more information. 
 
 ### Usability improvements 
 
@@ -2025,7 +2031,7 @@
 
 * **Last login** is now a default account attribute when [mapping data values from a file connector](/baton/file-connectors#map-data-values). For existing file connectors, refresh the connector's data to view and set this new mapping option. 
 
 * When setting up a policy that allows reassignment of tasks, you now have the option to limit which users a task can be reassigned to. Only the members of the reassignment allowlist will be available when a user reassigns a task.
 
 * You can now set a default access review view on a campaign or template. The default view setting (by app, by user, or unstructured) will open every reviewer's access reviews in the view you select, but reviewers can switch to a different view, if desired. 
 
@@ -2077,7 +2083,7 @@
 
 * The Workday connector now syncs security groups, and can be configured with a custom report in JSON format.  
 
 * You can now configure the Asana connector using a service account token. 
 
 * The AWS connector now syncs information on each account's last login. 
 
@@ -2123,7 +2129,7 @@
 
 ### Connectors 
 
 * The Jamf connector now syncs dynamic roles.  
 
 * The Google Cloud Platform connector now syncs organizations. 
 
@@ -2151,18 +2157,18 @@
 
 * New this week: [SAP SuccessFactors](/baton/successfactors), [Notion](/baton/notion), and [Jenkins](/baton/jenkins). 
 
 * The Tailscale connector now syncs roles, devices, and invites. 
 
 * The Dayforce connector now syncs roles and groups. 
 
 * The Google Workspace connector now syncs Google custom attributes.
 
 * These connectors received updates and fixes:
 
   * Azure Infrastructure (fixed sync errors when a mailbox fetch fails and errors when optional values were unset)
   * Entra ID (captures enterprise application usage)
   * Google BigQuery (fixed the cause of a sync error loop)
   * Okta (fixed errors that occurred when expected data was absent)
   * Workday (adds support for multiple roles in a custom report)
 
 ### Usability improvements 
@@ -2171,7 +2177,7 @@
 
 * You'll now find a **Created between** date range option when filtering tasks on the **Task log** page. 
 
 * Entitlement details are now shown in tooltips on the **Task log** page. 
 
 ### Fixed! 
 
@@ -2189,11 +2195,11 @@
 
 * New this week: [Redis](/baton/redis) and [Galileo Financial Technologies](/baton/galileo-ft).  
 
 * You can speed up the provisioning of Entra groups and roles by enabling the new **Schedule SCIM provisioning** option when configuring the Entra connector. This option forces a SCIM sync in Entra whenever new access is provisioned in C1. 
 
 * The Concur connector now supports role provisioning.  
 
 * The Litmos connector now supports course provisioning. 
 
 * The Azure Infrastructure connector now syncs storage accounts and storage account containers. 
 
@@ -2212,7 +2218,7 @@
 
 * To make it faster and easier to complete provisioning tasks, we've added the subject user's email address with a click-to copy button to the task assignment pane. 
 
 * Entitlement details are now shown in tooltips in tasks and when completing access reviews by app. 
 
 </Update>
 
@@ -2226,7 +2232,7 @@
 
 We're rolling out the ability to track usage data for key connected applications. Use this data to scope a UAR campaign to review grants that have gone unused lately.   
 
 * Opt into tracking Microsoft Entra usage data by enabling **Fetch user sign-in activity** on the Entra configuration page. 
 
 * The Okta v2 connector now collects usage data for Okta and the applications that Okta users SSO into. No configuration is needed.  
 
@@ -2242,10 +2248,10 @@
 
 * These connectors received updates and fixes:
 
   * Snyk (fixed an issue with provisioning organizations)
   * Zendesk (added additional error messages)
   * Snowflake v1 (fixed an issue with syncing users)
   * Databricks (fixed an issue with group provisioning)
   * Workday (added support for reporting user statuses)
 
 ### Usability improvements
@@ -2264,7 +2270,7 @@
 
 * Very large conditional expressions in policies can be successfully saved. 
 
 * Ownerless accounts are displayed correctly when reviewing campaign tasks by user. 
 
 * You can successfully duplicate any completed campaign. 
 
@@ -2282,7 +2288,7 @@
 
 ### Usability improvements
 
 * You can now mark tasks as provisioned or deprovisioned in bulk on the **Task log** page and your **Tasks** page.
 
 * We've added pagination to very long lists of entitlements on the **Manage access** page's **Browse** tab. 
 
@@ -2306,7 +2312,7 @@
 
 * These connectors received updates and fixes:
 
   * Okta
   * Google Workspace 
   * Azure Infrastructure 
 
@@ -2323,9 +2329,9 @@
 
 ### Connectors 
 
 * New this week: [Microsoft Azure Infrastructure](/baton/azure-infrastructure), [VictorOps](/baton/victorops) (aka Splunk On-Call).
 
 * When configuring the Microsoft Entra ID connector, you can now specify your Microsoft Graph API domain. 
 
 * These connectors received small updates and fixes:
 
@@ -2361,8 +2367,8 @@
 * These connectors received small updates and fixes: 
 
   * Salesforce (now only syncs accounts with a `UserType` value of `Standard`)
   * Databricks (fixed `failed to expand grant` error)
   * Coupa (fixed provisioned roles being deleted on the next sync)
   * Confluence (fixed group provisioning error)
 
 ### Usability improvements 
@@ -2381,17 +2387,17 @@
 
 <Update label="February 14, 2025">
 
 ### Automated unenrollment from access profiles  
 
 We're excited to launch automated unenrollment for access profiles, complementing our previously released enrollment functionality.  Now, when a user no longer meets the membership conditions of an access profile, C1 automatically initiates the unenrollment process you've configured.
 
 To learn more about unenrolling users, check out [Automate onboarding & offboarding access changes](/product/admin/dynamic-access-control).
 
 ### Connectors 
 
 * New this week: [PingFederate](/baton/pingfed).
 
 * The Asana connector now supports provisioning of teams and workspaces.
 
 * These connectors received small updates and fixes: 
 
@@ -2399,13 +2405,13 @@
   * Google Workspace 
   * Slack
   * GitHub
   * Databricks 
 
 ### Usability improvements 
 
 * We've added click-to-copy controls to the tooltips that show user and account information, making it easier to grab an email address or other info for use elsewhere. 
 
 * If you're a manager or have the Access Request Helpdesk, Access Request Admin, or Super Administrator user roles in C1, you can now request an access profile for another user on the **Request access** form. 
 
 ### Fixed!
 
@@ -2433,7 +2439,7 @@
 
 ### Connectors 
 
 * The Jira connector now supports syncing project roles. 
 
 * We made updates and fixes to these connectors: 
 
@@ -2443,7 +2449,7 @@
 
 * The by-app access review experience has been revamped. This sleek, streamlined new design features expandable info panels, bulk actions, and clearer indicators of your progress through your assigned access reviews.
 
 * When you click on a task number, a drawer now opens containing the tasks's details, next steps, related tasks, and audit log. Score one for team #no-more-modals.
 
 * You now have the option to scope a campaign by resource type within an app. This option is especially helpful when used in a campaign template, allowing you to automatically generate, for example, a quarterly review of all the teams in GitHub.   
 
@@ -2461,16 +2467,16 @@
 
 * We made updates and fixes to these connectors: 
 
   * Okta v2 
   * Workday
   * Salesforce
 
 ### Usability improvements
 
 * We've redesigned the tooltips that show user and account information to make them more relevant and helpful. 
 
   <Frame>
   <img src="/images/product/assets/release-notes-31-jan-25.png" alt="The tooltip on a user account showing the new design, which includes a summary of the account information and profile attributes."/>
   </Frame>
 
 * When setting up an access review campaign template, you can now include instructions that will be displayed to each reviewer in campaigns created from that template. 
@@ -2491,7 +2497,7 @@
 
 * When completing access reviews by user, you'll now see an icon if the user's last login to the app was more than 30 days ago. 
 
 * If a revocation task has errored, the task's outcome is now shown as "Revocation errored" on the campaign's **Access reviews** page and in the campaign report.
 
 ### Fixed! 
 
@@ -2537,7 +2543,7 @@
 
   * Snowflake v2 (fixed the connector's behavior when lists return no results)
   * AWS v2 (fixed sync failures when an SSO user's status could not be fetched)
   * Temporal Cloud (fixed issues with namespace permission grants and extraneous role grants)
 
 ### Usability improvements
 
@@ -2557,7 +2563,7 @@
 
 * You can now set up the Workday connector using either a custom report or an API client. 
 
 * The Databricks connector now includes the option to pass in the hostnames needed to configure the connector for use with Google Cloud Platform or Azure Databricks. 
 
 ### Usability improvements