[midPoint] SOD Prune policy action — does it support priority/order-based conflict resolution?

[Bao Tran]

Hi all,
We're implementing a mutually-exclusive role set in MidPoint using an
exclusion policy constraint with action = prune:

Application:
*- VPN*

Application-roles:


*- VPN-access - VPN-manager- VPN-admin*

Only one of these three application roles should be assigned to a user at a
time . And if there is a SOD situation detected  => select the
application-role with highest rank (access -> manager -> admin) , and prune
others.
Per the SOD actions documentation
<https://docs.evolveum.com/midpoint/reference/support-4.9/roles-policies/policies/policy-rules/#policy_actions>,
prune automatically and silently removes conflicting assignments when a new
one is added.

Our question: does prune have any built-in mechanism to resolve conflicts
based on role priority/order/rank (e.g. always keeping the
highest-privilege role regardless of assignment sequence)? Or is the
removal purely based on assignment order — i.e. the newest assignment
always survives and the pre-existing conflicting assignment is the one
pruned, regardless of relative privilege level?

If there's no built-in support for priority-based resolution, could you
point us to the recommended pattern for enforcing "always keep highest-rank
role" semantics — e.g. a policy rule script hook that runs before prune, or
an object template / afterAssignments mapping approach?


Thanks,

-- 
Bao Tran
Software developer
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20260806/0e18042a/attachment.htm>