---
title: Preview features
description: Identity and access features you can configure through the API
  today but that do not yet change, or only partly change, who can do what.
url: https://hexelstudio.com/docs/identity/preview
---

<Warning>
Most Preview features store configuration but do not change the result of your normal API calls yet. Read the "Takes effect today?" column below and the warning at the top of each Preview page before you rely on one for security. Preview APIs may change without notice: paths, fields and behavior.
</Warning>

## What Preview means

A feature is in Preview when its API is public and works, but the feature is not finished. For a Preview feature:

- The API accepts, validates, stores and returns your configuration. Each page lists the permission each call needs.
- The configuration may not affect access yet. Each Preview page starts by saying, in plain words, what does not take effect, and then documents what does.
- The API may change. Paths, request and response fields, permission names and behavior can change before the feature leaves Preview, without a deprecation period.

Do not use a Preview feature as your only control for something that must be enforced. Use the features in the guides instead: [policies](https://hexelstudio.com/docs/identity/write-policies), [groups](https://hexelstudio.com/docs/identity/groups), [roles](https://hexelstudio.com/docs/identity/roles) and [service users](https://hexelstudio.com/docs/identity/service-users).

## Two ways a request is checked

To read the "Takes effect today?" column, you need to know that Hexel Studio has two decision paths.

**The cached permission check** decides your normal API calls. It looks only at the **Allow** statements of the policies that apply to the caller: policies attached to the member or service user, to its groups, and through permission sets. For a role session it uses the role's policies, capped by the role's permission boundary. It ignores everything else on the Preview list, including **Deny** statements.

**The full evaluator** runs more steps: service control policies, resource control policies, permission boundaries on members and service users, session policies, Deny statements and ABAC rules. It is used by:

- `POST /v1/authz/evaluate`, `POST /v1/authz/simulate` and `POST /v1/authz/explain` (see [Test access](https://hexelstudio.com/docs/identity/test-access)).
- The check Hexel Studio makes on the caller's own organization when a member or service user assumes a role in another organization (see [Roles](https://hexelstudio.com/docs/identity/roles)).

<Note>
Because the two paths differ, `/v1/authz/*` can answer "denied" for a call that succeeds when you make it for real. A feature that only the full evaluator reads changes those answers, not your API calls.
</Note>

## Preview features

| Feature | Page | Takes effect today? |
| --- | --- | --- |
| Permission boundary set as a role's `boundary_id` | [Guardrails](https://hexelstudio.com/docs/identity/guardrails) | **Yes.** It caps every call made with that role's sessions. |
| Permission boundaries on members and service users | [Guardrails](https://hexelstudio.com/docs/identity/guardrails) | No. Only in the full evaluator. |
| Permission boundaries on groups and roles (`target_type` `GROUP` or `ROLE`) | [Guardrails](https://hexelstudio.com/docs/identity/guardrails) | No. They cap nothing, in either path. |
| Service control policies (SCPs) | [Guardrails](https://hexelstudio.com/docs/identity/guardrails) | No. Only in the full evaluator. |
| Resource control policies (RCPs) | [Guardrails](https://hexelstudio.com/docs/identity/guardrails) | No. Only in the full evaluator, and only when the request names a resource type. |
| Deny statements in policies | [Guardrails](https://hexelstudio.com/docs/identity/guardrails) | No. Only in the full evaluator. |
| Workload identity providers and `Federated` trust principals | [Workload identity](https://hexelstudio.com/docs/identity/workload-identity) | No. A workload cannot exchange its token for a Hexel Studio token yet. Trust simulation works. |
| Just-in-time access requests | [Just-in-time access](https://hexelstudio.com/docs/identity/just-in-time-access) | No. An approved or active request grants nothing. |
| Approval workflows and requests | [Just-in-time access](https://hexelstudio.com/docs/identity/just-in-time-access) | No. An approved request changes nothing. |
| Access reviews | [Access reviews](https://hexelstudio.com/docs/identity/access-reviews) | No. A `REVOKE` decision removes no access. Schedules never run. |
| Organization-wide audit logs (`GET /v1/organizations/{organization_id}/audit-logs`, `GET /v1/audit/logs`) | [Audit logs](https://hexelstudio.com/docs/identity/audit-logs) | No. No new events are written to them; group history works. |
| `Resource` and `Condition` in policy statements | [Fine-grained access](https://hexelstudio.com/docs/identity/fine-grained-access) | No. Stored and ignored in both paths. |
| Resource policies | [Fine-grained access](https://hexelstudio.com/docs/identity/fine-grained-access) | No. Stored only. |
| Relationship tuples and namespaces | [Fine-grained access](https://hexelstudio.com/docs/identity/fine-grained-access) | No. The relation check endpoint answers, but no access decision reads tuples. |
| ABAC attributes and policies | [Fine-grained access](https://hexelstudio.com/docs/identity/fine-grained-access) | No. Only in the full evaluator. |
| Tags | [Fine-grained access](https://hexelstudio.com/docs/identity/fine-grained-access) | No. Stored only. |
| Session policies | [Session policies](https://hexelstudio.com/docs/identity/session-policies) | No. Only in the full evaluator. |
| SIEM export | [SIEM export](https://hexelstudio.com/docs/identity/siem-export) | No. Nothing is sent to your SIEM. |
| Audit reports, scans, findings and retention policies | [SIEM export](https://hexelstudio.com/docs/identity/siem-export) | No. Stored only. Scans never run and retention is not applied. |

## Who can use Preview APIs

Preview APIs use the same permissions model as the rest of the API. Each page lists the action each endpoint needs, and notes any endpoint that checks no specific action. Organization owners hold every action. To give someone access to a Preview API, attach a policy that allows its actions, as described in [Write policies](https://hexelstudio.com/docs/identity/write-policies).