❗The functionality described in this article won't be available until the full feature release.
Condition Packages are the base for Conditional Policies; they allow you to bundle different Conditions together, to define cases in which the respective Conditional Policies are applied.
In this article, we'll learn how to set them up and how to avoid certain inconsistencies that might derail your governance infrastructure.
💡 Please make sure that you've read our Introduction to Conditional Policies article before reading this one!
🧩 Condition Package Logic
A Condition Package is nothing more than a bundle of one or more Conditions that must be met in order for it to resolve True.
Different Conditions are linked together with AND/OR logic:
AND - both Conditions must be met for the Package to resolve True.
OR - either one of the Conditions needs to be met for the Package to resolve True.
1. AND Logic
With the AND modifier, if all Conditions within a Package resolve as True, the Package as a whole resolves True as well. If only some of the Conditions within a Package resolve as True, the Package as a whole resolves False.
Example:
Condition Package - In order for our Package to resolve True, the Team must have a Confidential Sensitivity Label and must include the word Confidential in its title as well.
Team - Our Team has the Confidential Sensitivity Label and is titled "P_Marketing_Public".
Result - Since our Team qualified for only one of the Conditions in the Condition Package, the Package will resolve to False, and the corresponding Governance Setting won't be activated.
Now, let's keep the same Condition Package and try a different Team.
Team - Our new Team has the Confidential Sensitivity Label and is titled "P_Marketing_Confidential".
Result - Since our Team qualifies for both of the Conditions in our Condition Package, the Package will resolve to True, and the corresponding Governance Setting will be applied.
2. OR Logic
With the OR modifier, if one of the Conditions within a Package resolves as True, the Package resolves True as a whole. If both of the Conditions within a Package resolve as True, the Package also resolves as True.
Let's stick with the same example as above, but change the Conditional Modifier to OR.
Result - Since our first Team qualifies for one of the Conditions in the Condition Package, the whole Package resolves to true, and the corresponding Governance Setting is applied.
Now, let's check how the OR modifier behaves with our second Team.
Result - Since our Condition Package requires one of the Conditions within it to resolve to True and our Team qualifies for both of them, the entire Package is resolved as true, and the corresponding Governance Setting is applied.
⚙️ Condition Package Setup
You can set up your Packages through a simple Conditional Logic interface.
Navigate to Settings > Expert mode > Condition Packages to get started.
Click on + Create condition package.
Give your Conditional Package a Name and a Description.
Specify the desired Condition. Currently, Conditions can be based only on Group Properties (Name, ID, Sensitivity Label); however, in the future, Requester, Guest, and Organization Properties will be added as well.
Consider adding a second Condition by clicking on the + Add condition button at the bottom of the Condition box. You can select how the two conditions interact via the AND/OR modifier dropdown.
Also, consider adding a Nested Condition by clicking on + Add nested condition. You can control how the two Conditions interact via the AND/OR modifier dropdown between them.
Click Save changes to finalize your new Package.
Once your Condition Package has been saved, you're free to use it with the Governance Setting of your choice.
⚠️ Avoiding Logical Fallacies
The Conditions you set in order to qualify different Teams for a certain Governance Setting are incredibly important. It's possible to create scenarios that will NEVER resolve as True and subsequently serve no purpose.
Linking two Conditions of the same Category with an AND modifier will result in a contradictory Condition Package that can never resolve True.
For instance, you might create a Condition where the Name of the Team must simultaneously equal "Confidential" and "Highly Confidential".
Since a Team Name is a singular property, this Condition can never resolve True, and thus any Governance Settings attached to it will never trigger.
💡 This is easily resolved by switching the Conditional Modifier to OR instead of AND, or switching the condition from Equals to Contains.
Alternatively, you might set a Condition where a Team must adhere to two separate Sensitivity Labels. Once again, since a Sensitivity Label is a singular property, this Condition will never resolve True.
💡 Removing one of the Label Conditions or switching the Conditional Modifier to OR will be enough to resolve this issue.
👣 Next Steps
Now that you have a deep understanding of how Conditional Packages work, it's a good idea to get a better grasp on Prioritizing Conditional Policies.
Alternatively, you can explore specific Conditional Governance Settings:
⛑️ Need more help?
Get further assistance with External User Manager through our support chat widget within the app, or reach out to us at [email protected]