This statement is correct. IdentityIQ uses rule types and rule metadata to guide engineers when creating or editing rules. The Rule Registry describes expected rule behavior, including contextual information such as the rule’s purpose, expected inputs, and often the intended output or return behavior. This is important because IdentityIQ rules are not generic scripts running in isolation; they execute in specific product contexts such as aggregation, correlation, provisioning, workflow, certification, policy evaluation, or lifecycle processing. The rule editor can expose information derived from the rule registry so that an engineer understands which variables are available and what the rule is expected to return. This reduces implementation errors, especially in DOMC-style topics where a wrong return type or missing context variable can cause runtime failures. The Word bank separately confirms that the BeanShell rule editor lists typical input variables based on the rule registry. References/topics: IdentityIQ Engineer — Rule Registry, BeanShell rule editor, rule metadata, expected inputs, expected outputs.

Yes. In IdentityIQ workflow XML, subprocess calls can exchange data with the calling workflow through configured input and output variable handling. The send attribute is used to pass variables into the subprocess, while the returns attribute identifies variables that should be returned from the subprocess to the parent workflow context. This is important when a reusable subprocess performs initialization, provisioning-plan generation, identity-request creation, approval preparation, or other common logic and the parent workflow needs the resulting values. In the example, identityName and plan are sent into the subprocess, while identityRequestId and project are expected back. This is a valid workflow pattern and is one reason standard LCM subprocesses can be reused in custom workflows. The engineer must still ensure that variable names match and the subprocess actually sets the returned variables. References/topics: IdentityIQ Engineer — workflow subprocesses, send attribute, returns attribute, workflow variables, reusable LCM workflows.

Allow is a valid action when acting on a policy violation, assuming the policy violation owner has the required permissions. In IdentityIQ compliance workflows, not every violation is immediately remediated. Some violations are business-approved exceptions, temporary exceptions, or accepted risks. The Allow action is used to acknowledge that the violation may remain in place, often with justification, comments, expiration, or compensating-control context depending on configuration. This is different from remediation, where access is changed or removed, and different from mitigation, where a mitigating control is attached. In the Account Policy context, the violation may indicate that a user exceeds a permitted account condition. If the business determines the condition is acceptable, the owner may allow it rather than immediately remove or alter an account. This is a legitimate compliance decision, provided the user has permission to take that action. References/topics: IdentityIQ Engineer — policy violation lifecycle, Account Policy, allow/exception handling, mitigation, remediation, Compliance Manager.

Yes, the typical input variables for a rule are listed in the BeanShell rule editor in IdentityIQ, based on the rule registry. When you create or edit a rule in IdentityIQ using the BeanShell editor, the available input variables that are relevant to the rule type are typically pre-defined and listed based on the rule registry. These input variables provide context and data that the rule can operate on, and their availability helps guide the rule development process.

Therefore, the correct answer is A. Yes.

Yes, defining account correlation via a rule is an action that can be performed as part of configuring an application definition in SailPoint IdentityIQ. Account correlation rules are often used to determine how accounts from different sources are linked to identities within IdentityIQ. These rules allow for complex logic to be applied when matching accounts to identities, beyond simple attribute matching.

SailPoint IdentityIQ Administration Guide (Section on Account Correlation)

SailPoint IdentityIQ Application Configuration Guide (Using Rules for Account Correlation)

Yes. LCM provisioning workflows contain control behavior for handling provisioning operations that are not completed synchronously. A queued result is materially different from a failed result: IdentityIQ has successfully submitted the request into a provisioning path, but the downstream operation has not necessarily completed yet.

LCM processing can therefore be configured so that asynchronous/queued provisioning does not cause the overall request workflow to be treated as an immediate provisioning failure. This is important for connectors and integrations where target operations are queued, brokered, or fulfilled asynchronously. Otherwise, the workflow could incorrectly follow failure handling merely because the target-system change was not completed during the same execution thread.

The engineer must still distinguish this from claiming that the target access has definitely been provisioned. “Successful” at this workflow stage means the request was accepted into the expected provisioning process. Subsequent transaction processing, retries, aggregation, or request maintenance can establish the final state.

This is precisely why provisioning status management is a workflow concern, whereas whether an application supports a particular account operation is an application/connector concern.

References/topics: IdentityIQ Engineer — LCM provisioning workflows, asynchronous provisioning, queued provisioning status, ProvisioningProject, provisioning transaction status, request maintenance.

=======

Yes. Identity Provisioning Policies provide the field definitions and associated behavior used for identity-management operations such as Create Identity and Edit Identity . They can control which identity attributes are presented, which are required, what defaults or calculations are performed, and what validation or allowed-values logic applies.

For identity creation, the Create Identity Provisioning Policy defines the information collected when an authorized user creates an identity through IdentityIQ. Update/Edit behavior can similarly be governed through the appropriate identity provisioning policy. This allows implementations to expose controlled identity-management functionality without relying on arbitrary direct editing of Identity objects.

This proposition is different from two related items already in the Word bank. The bank contains a proposition stating that a Create Identity policy is applied during authoritative-source aggregation, and another covering allowed-values/validation logic when using Create Identity. Neither is the same DOMC proposition as defining policies for create/edit operations through the IdentityIQ UI.

Therefore, this is a separate unique question and the answer is Yes.

References/topics: IdentityIQ Engineer — Identity Provisioning Policies, Create Identity, Edit Identity, form fields, validation, identity lifecycle management.

=======

The statement is incorrect. Email templates in SailPoint IdentityIQ are not restricted to just Identity object attributes or methods. They can access attributes and methods of any object passed to the template through its input arguments, including WorkItems, CertificationItems, and others. The template system allows the use of various objects’ properties as long as they are properly referenced within the script or template context.

Yes, disabling all notifications can be achieved via configuration of control variables in the out-of-the-box Lifecycle Manager (LCM) workflows. In SailPoint IdentityIQ, most workflows, including those in LCM, use control variables to manage various settings, such as whether notifications should be sent. By setting the appropriate control variable (e.g., disabling email notifications) within the workflow configuration, you can effectively suppress all notifications related to that workflow.

Therefore, the correct answer is A. Yes.

Filter String is not required when setting up every IdentityIQ application. A filter string is a connector-specific or configuration-specific option used in some application definitions to limit which accounts, groups, or objects are included during aggregation or connector operations. For example, LDAP-style connectors may use filters to restrict returned accounts, and other connector types may expose filter-like options depending on the source system. That does not make Filter String a universal mandatory field. IdentityIQ applications require core configuration such as application name, connector/type selection, schema information, and account identity handling, but not every application needs a filter. Some applications aggregate all accounts from the configured source, while others use connector-specific search, API, file, or database settings. Treating Filter String as universally required would be wrong because it depends on connector type and business filtering requirements. References/topics: IdentityIQ Engineer — application definition, connector configuration, aggregation filtering, required versus optional application settings.