Documentation
Back to Security Overview
Group Cleanup
Which groups can safely be deleted. Tracing a group through everything that could depend on it is days of work by hand, so it is never done — and the access surface only grows. Group Cleanup is the fourth tab of the Security Report.
What it reads, per group
- Membership — read from the native directory, with grants inherited through parent groups counted against the group.
- Grants — object ACLs and role assignments that name the group.
- Workflow — approval units the group owns, navigation flows and Task Manager assignments that reference it.
- Full-text scan — every artifact in the snapshot is searched for the group name. Files that are directory dumps — a listing that names every group — are vetoed by a density rule, so a group is not marked in use because it appears in a user export.
Five verdicts, one of them actionable
| Verdict | Meaning |
|---|---|
| SafeToDelete | Every pass ran, and none of them found the group granting, owning or being referenced by anything. The only actionable verdict. |
| InUse | The group grants access, holds a role, owns an approval unit, or is referenced by a navigation flow, a Task Manager assignment or an artifact. |
| GrantsNothing | The group exists and has members, but no ACL or role assignment points at it. Worth a look, not a deletion. |
| NoMembers | The group grants something but nobody is in it. Also worth a look, and also not a deletion on its own. |
| Unknown | A pass did not run — a source was unavailable or a read failed — so no claim is made either way. It is never rounded up to Safe. |
The panel fails closed. Coverage — which passes ran and what each one read — is printed verbatim under the verdicts, so the tab never implies more than it actually checked. Only SafeToDelete offers an action; the others explain themselves.
Using it
- Run Sync Metadata so the snapshot is current; the scan reads the snapshot, not the live pod.
- Open System & Security → Security Report and switch to the Group Cleanup tab.
- Read the coverage line before the verdicts. If a pass shows as not run, the verdicts below it are Unknown, not Safe.
- Delete only from SafeToDelete, and delete in Oracle's Access Control, where the change is audited by Oracle's own separate trail.