Some workspaces also have specialized tools enabled for threat investigation or advanced SQL queries. See Oleria MCP tools for what they cover.
Access and permissions
Queries the full identity and access graph - accounts, identities, application accounts, groups, roles, permissions, resources, applications, departments, and employees, and the relationships between them. A single question can span all of these at once; you don’t need to break it into a query per entity type.- “Which admin accounts don’t have multi-factor authentication (MFA) enabled?”
- “List external users who’ve been dormant for more than 90 days.”
- “What resources can this user access, and through which group?”
- “External users in Google Drive who have access to confidential files.”
- “Top 10 accounts by permission count in Salesforce.”
Usage and activity
Login patterns, permission utilization, application usage, and behavioral anomalies - built for questions scoped to a specific identity, group, or time window rather than a sweep across your whole workspace. For a broad question, Oleria MCP gets better results by first finding the relevant accounts or identities, then pulling activity for just that group.- “Show me the most active users in the last 30 days.”
- “Which permissions in this application are assigned but never used?”
- “Find identities with no activity in GitHub in the last 90 days.”
- “Analyze login patterns for the finance department.”
Risk and security posture
Two complementary tools cover this: one queries risk violations Oleria has already detected (by severity, category, application, or service-level agreement (SLA) status), the other returns pre-aggregated metrics across dozens of named areas without running a fresh query each time. See the metrics reference for the full list of areas.- “Show me all Critical severity risk violations in AWS.”
- “What MFA-related risks are detected across all applications?”
- “Give me a security posture overview: risk, MFA, password, and account hygiene.”
- “Find risk violations that are out of SLA.”
Access governance
Covers the three systems behind Oleria’s governance features:- Access reviews - campaign status and completion metrics, reviewer decisions, AI-generated risk signals (dormant days, peer group comparison, login frequency, organizational changes) behind each recommendation, and remediation status once access is revoked.
- Identity lifecycle management - joiner, mover, and leaver automation, including Access Bundles: sets of access built from what similar employees already hold, with recommendations to adjust the bundle and alerts when someone’s access drifts from their peer group.
- Workflow automation - the workflows automating actions like disabling dormant accounts, non-human identity (NHI) ownership and credential management, and ticket creation, with execution history and pending approvals.
- “Show me all active access review campaigns and their completion percentages.”
- “Which review items have a revoke recommendation but are still pending a decision?”
- “Which reviewers still have pending items in the Q3 campaign?”
- “What access bundles were provisioned for employees who joined in the last 30 days?”
- “Which bundles have pending recommendations to add entitlements held by more than 50% of peers?”
- “Which leavers still have accounts that weren’t successfully disabled?”
Integrations
Connected integrations (health status, last sync time) or the full catalog of what’s available to add, including each application’s category and what data it would bring in.- “Which integrations are failing?”
- “When did Slack last sync?”
- “Do you support GitHub?”
- “What’s available to connect in the HR systems category?”