How rules work
A rule has three parts:- Trigger — the event type that starts the evaluation
- Conditions — AND-matched filters that narrow which events activate the rule
- Actions — what happens when all conditions match
Creating a rule
- Go to Workflows → Rules
- Click New Rule
- Give it a name and optional description
- Choose a trigger type
- Add conditions
- Configure one or more actions
- Set the rule to Active and save
Supported trigger categories
Rules can respond to supported events from connected integrations. Available categories and fields depend on the workspace configuration and enabled integrations:When new-grant rules run
Porcia looks for new OAuth grants on every sync with your identity provider, scheduled or started with Sync now. Each new grant goes through your OAuth rules, auto-revoke rules, pulses and alerts once, within two weeks of Porcia first seeing it.- Your starting point: grants found on the first sync after you connect a provider show on the OAuth Grants page and in Findings, but don’t trigger new-grant rules, pulses or alerts.
- Apps that aren’t counted: grants to apps held for review, apps your own organization registered, and apps set aside don’t trigger them.
When new-app rules run
Application rules on a new app run once per app, when discovery first adds it to your app inventory: from a sign-in or OAuth grant in your identity provider, from email discovery, from the browser extension, or from a license your tenant holds. An app held for review runs them once more evidence brings it into your inventory. Apps you add or confirm yourself don’t run them, and neither do apps added by a person’s answer to a question about a held app (Apps to review). That answer triggers Pulse responded, as every pulse answer does.- Your starting point: apps found in the first day after you connect a source are the inventory you start from, and don’t trigger new-app rules. Neither does an app Porcia first saw more than two weeks before adding it.
- Apps that aren’t counted: Porcia’s own app, your own organization’s sites and apps, your identity provider’s own apps, and apps held for review or set aside don’t trigger them.
Conditions
All conditions must match (AND logic). Conditions narrow the trigger to specific cases:- For apps: category, risk level, discovery source, approval status
- For OAuth grants: risk level, permission scopes, grant age, publisher trust score
- For users: group membership, department, directory status, last active date
Actions
Slack actions need a Slack connection in Settings → Integrations.
Example rules
Alert on new high-risk Shadow Apps
- Trigger: Application — new app discovered
- Conditions: Approval status = Pending, Risk level = High or Critical
- Action: Slack message to
#security-alerts
Flag stale OAuth grants
- Trigger: OAuth — grant not used recently
- Conditions: Days since last use ≥ 90
- Action: Email the IT admin
Watch for deprovisioned users with active access
- Trigger: Account — user deactivated in directory
- Conditions: User has active app assignments
- Action: Slack message to the IT admin
Check in on new AI tools
- Trigger: Application — new app discovered
- Conditions: AI classification = AI Primary or AI Enhanced
- Action: Pulse the users of the app to confirm the business need
Managing rules
Active / Paused — toggle rules on or off without deleting them. Useful when you want to temporarily suspend a noisy rule without losing its configuration. Edit — modify conditions and actions. Future matching events use the saved configuration.Current limitations
All conditions in a rule must match. For “either/or” cases, create a separate rule for each condition.Next steps
Findings
Review security and access findings
Playbooks
Run multi-step governance workflows
Pulses
Send employee outreach as a rule action
OAuth Grants
Set up automated alerts on risky grants