Configuring Rotation Policies

Policies control the schedule and behaviour of automated verification and rotation. A credential can have one Verification Policy and one Rotation Policy attached simultaneously.

Assigning a policy to a credential activates scheduled operations for that credential. Removing the policy disables scheduling, the credential can still be verified or rotated manually at any time.

---

Verification Policies

A Verification Policy defines how often GAccess checks that a stored credential is still valid on the target system, and when it stops retrying after repeated failures.

Field	Description	Default
Name	Identifier shown on the credential detail view.	—
Interval	How often GAccess schedules a new verify job (e.g. every 24 hours).	—
Schedule window	Optional time window within which scheduled jobs are created. Start time, end time, and timezone. Jobs due outside the window are deferred to the next opening.	No restriction
Max Consecutive Failures	Number of consecutive failures before the credential is paused. Range: 1–10.	3
Pause Duration	How long verification is paused after reaching the failure threshold.	24 hours

---

Rotation Policies

A Rotation Policy defines when GAccess rotates a credential, what the new credential looks like, and how failures are handled.

Schedule settings

Field	Description
Frequency	How often rotation runs: hourly, daily, weekly, or monthly.
Schedule window	Time window (start time, end time, timezone) during which rotation jobs may be created. Rotations due outside the window are deferred to the next opening. For hourly frequency, a 1-hour default window applies if no end time is set.
Days of week	For weekly frequency: the days on which rotation is allowed to run.

Failure handling settings

Field	Description	Default
Max Retries	Number of consecutive failures before rotation is paused. Range: 1–10.	3
Pause Duration	How long rotation is paused after reaching the failure threshold.	24 hours

Password rules

These rules apply to all password credentials using this policy, including manually triggered rotations.

Rule	Description
Minimum length	Minimum number of characters in the generated password.
Maximum length	Optional upper bound. Leave blank for no maximum.
Uppercase letters	Whether at least one uppercase letter is required.
Lowercase letters	Whether at least one lowercase letter is required.
Numbers	Whether at least one digit is required.
Special characters	Whether special characters are required, and which characters are allowed.
Excluded characters	Characters that must never appear in the generated password.

SSH Key rules

These rules apply to Private Key credentials using this policy.

Rule	Description
Algorithm	Key algorithm: Ed25519 (recommended) or RSA.
Key size	For RSA: the key size in bits. Leave blank for the algorithm default.

Checkout Rotation

When Checkout Rotation is enabled on a policy, rotation is also triggered automatically whenever a privileged session using that credential ends — regardless of the scheduled window. This ensures credentials are rotated after every use, regardless of when the session occurred.

---

Attaching a policy to a credential

1. Navigate to Privileged Access → Credentials and open the credential.
2. Click Edit.
3. In the Rotation or Verification section, select the desired policy from the dropdown.
4. Save the credential.

Once saved, the credential is picked up by the scheduler on its next cycle and becomes eligible for automated jobs according to the policy settings.

To detach a policy, clear the selection in the same field and save. Any job already in the queue will still execute, but no new scheduled jobs will be created.