Abstract: In an identity governance system, processes enable secure delegation of authority to create and manage identities for users of a computer network and to provision access entitlements to users to network resources in a manner that ensures compliance with security and access policies. The provisioning of access entitlements to users is controlled based on a model of relationships between business entities that the computer network serves. Identities of users are assigned to a node of the model. Provisioning of entitlements for coarse and fine-grain access is restricted based on this assignment. The node of the business relationship model limits the scope of what user access entitlements can be assigned, to whom they may be assigned, and who may assign them.