Entitlements control what items and actions are available in the service catalog for the selected business group members. An entitlement must be active for the items to appear in the service catalog. If you have items that require governance, you can use entitlements to apply approval policies to different items.

To configure the entitlement, the catalog items must be included in a service. Entitlements can include catalog items from multiple services.

You must consider the interactions of services, catalog items, actions, and approvals when you create an entitlement.


An entitled service operates as a dynamic group of catalog items. If a catalog item is added to a service after it is entitled, the new catalog item is available to the specified users without any additional configuration. If you apply an approval policy to a service, all the items, when requested, are subject to the same approval process.


Entitled catalog items can include any of the following items:

  • Items from any service that you want to provide to entitled users, even services not included in the current entitlement.

    For example, as a catalog administrator you associated several different versions of the Red Hat Enterprise Linux with a Red Hat service and entitle the service to the quality engineers for product A. Then you receive a request to create service catalog items that includes only the latest version of Linux-based operating systems for the training team. You create an entitlement for the training team that includes the latest versions of the other operating systems in a service. You already have the latest version of RHEL associated with another service, so you add RHEL as a catalog item rather than add the entire Red Hat service.

  • Items that are included in a service that is included in the current entitlement, but you want to apply an approval policy to the individual catalog item that differs from the policy you applied to the service.

    For example, as a business group manager, you entitle your development team to a service that includes three virtual machine catalog items. You apply an approval policy that requires the approval of the virtual infrastructure administrator for machines with more than four CPUs. One of the virtual machines is used for performance testing, so you add it as a catalog item and apply less restrictive approval policy for the same group of users.

  • Items that are not available for a service catalog user to request on their own because they are a component of a provisionable item, but to which you want to apply a specific approval policy that differs from the catalog item in which it is included.

    For example, an item includes a machine and software. The machine is available as a provisionable item and has an approval policy that requires site manager approval. The software is not available as a standalone, provisionable item, only as part of a machine request, but the approval policy for the software requires approval from your organization's software licensing administrator. When the machine is requested in the services catalog, it must be approved by the site administrator and the software licensing administrator before it is provisioned. After it is provisioned, the machine, with the software entry, appears in the requestor's Items tab as part of the machine.


Actions run on provisioned catalog items. To provision a catalog item, you request the item in the service catalog. To run actions on a provisioned item, the action must be included in the same entitlement as the catalog item that provisioned the item from the service catalog.

For example, entitlement 1 includes a vSphere virtual machine and a create snapshot action, and entitlement 2 includes only a vSphere virtual machine. When you deploy a vSphere machine from entitlement 1, the create snapshot action is available. When you deploy a vSphere machine from entitlement 2, there is no action. To make the action available to entitlement 2 users, add the create snapshot action to entitlement 2.

If you select an action that is not applicable to any of the catalog items in the entitlement, it will not appear as an action on the Items tab. For example, your entitlement includes a vSphere machine and you entitle a destroy action for a cloud machine. The destroy action is not available to run on the provisioned machine.

You can apply an approval policy to an action that is different from the policy applied to the catalog item in the entitlement.

If the service catalog user is the member of multiple business groups, and one group is only entitled to power on and power off and the other is only entitled to destroy, that user will have all three actions available to them for the applicable provisioned machine.

Approval Policies

To apply an approval policy when you create the entitlement, the policy must already exist. If it does not, you can still create the entitlement and leave it in a draft or inactive state until you create the approval policies needed for the catalog items and actions in this entitlement, and then apply the policies later.

You are not required to apply an approval policy to any of the items or actions. If no approval policy is applied, the items and actions are deployed when requested without triggering an approval request.