Introduction

Private preview: Comply is in private preview and available to select accounts. Contact your Immuta representative for details.

Immuta helps you grant access to data through Govern policies and Request access requests; Comply builds on that access model by helping you understand the results of those grants. The Comply app is an AI-powered conversational agent that provides visibility into what data your users can access, how they received access, and which policies, tags, requests, groups, or attributes are involved in determining the access.

Comply can be used to answer access questions like the following:

• Which users have access to sensitive customer data?
• What policies are granting the most access?
• Which users have access to a specific data source or data product?
• Which groups have access to the largest number of data sources?
• How would access change if this tag was added to this policy?

Comply is powered by access summary information in Immuta. The access summary export is a snapshot of current access in Immuta and can be used to understand what users have access to at a moment in time and why.

Comply is not a replacement for audit logs, where you need a chronological record of the user actions that led to access. For an audit trail of user activity, use Immuta audit logs.

Use cases

Recertification campaigns

Recertification and regular access reviews can use the access summary export and the AI chat.

• Generate access review reports from the access summary export for tools like SailPoint or ServiceNow that show which users have access to sensitive data and how they received it. For example, a reviewer can see whether a user received access to a customer table through a data product approval, a subscription policy, or ownership.
• Then the human reviewers can use the AI chat to deeply understand access and ask specific questions into why access exists before deciding whether to recertify or revoke the access.

Access investigation

Ask targeted questions when you need to understand access quickly. You can now easily understand which user can access which data source without digging through Immuta audit logs or governance reports. When a credential is compromised, identify all sensitive assets the account can currently access and why, making the blast radius clear.

Custom access dashboards

Export access summary data and create dashboards in your preferred data platform or BI tool. Your governance users can then visually see what users can currently access what data and what is granting them access. This can allow you to see anomalies or trends quickly to address or automate.

AI chat

AI-powered feature

Comply uses an LLM-powered chat experience to help users ask natural language questions about access summary data. Access reviews often require reviewers to answer more than “Does this user belong to this group?” Reviewers also need to know what that group, policy, request, or attribute actually gives the user access to.

Comply helps reduce the guesswork in access reviews by surfacing the access context reviewers need. You can use the Comply app to investigate access before or during recertification campaigns by using natural language prompts to get clear, easy-to-understand answers immediately, without having to know the right query to use or report to look for.

For instructions on using the AI chat, see the Using Comply guide.

Access summary export

In addition to conversational answers in the Comply app, you can use the access summary export to build custom dashboards and reports in your own tools.

The access summary export can be exposed as external tables in your data platform, queried interactively, or used in BI dashboards to visualize access. This can help compliance, governance, and data teams answer recurring access questions without manually stitching together requests, policies, audit records, user attributes, data source metadata, and governance reports.

For more details, see the Access summary export reference guide.

Limitation

Thread (or chat) titles will not be generated if you are using the Comply app in the AP region.