Documentation
Back to Security Overview

Group Cleanup

Which groups can safely be deleted. Tracing a group through everything that could depend on it is days of work by hand, so it is never done — and the access surface only grows. Group Cleanup is the fourth tab of the Security Report.

What it reads, per group

  • Membership — read from the native directory, with grants inherited through parent groups counted against the group.
  • Grants — object ACLs and role assignments that name the group.
  • Workflow — approval units the group owns, navigation flows and Task Manager assignments that reference it.
  • Full-text scan — every artifact in the snapshot is searched for the group name. Files that are directory dumps — a listing that names every group — are vetoed by a density rule, so a group is not marked in use because it appears in a user export.

Five verdicts, one of them actionable

VerdictMeaning
SafeToDeleteEvery pass ran, and none of them found the group granting, owning or being referenced by anything. The only actionable verdict.
InUseThe group grants access, holds a role, owns an approval unit, or is referenced by a navigation flow, a Task Manager assignment or an artifact.
GrantsNothingThe group exists and has members, but no ACL or role assignment points at it. Worth a look, not a deletion.
NoMembersThe group grants something but nobody is in it. Also worth a look, and also not a deletion on its own.
UnknownA pass did not run — a source was unavailable or a read failed — so no claim is made either way. It is never rounded up to Safe.

The panel fails closed. Coverage — which passes ran and what each one read — is printed verbatim under the verdicts, so the tab never implies more than it actually checked. Only SafeToDelete offers an action; the others explain themselves.

Using it

  1. Run Sync Metadata so the snapshot is current; the scan reads the snapshot, not the live pod.
  2. Open System & Security → Security Report and switch to the Group Cleanup tab.
  3. Read the coverage line before the verdicts. If a pass shows as not run, the verdicts below it are Unknown, not Safe.
  4. Delete only from SafeToDelete, and delete in Oracle's Access Control, where the change is audited by Oracle's own separate trail.