Rules are where a SailPoint interview stops being a vocabulary test. Anyone can define identity governance; far fewer candidates can say which rule type fires during aggregation, why their rule ran without error and changed nothing, or what SailPoint's own rule guidelines forbid outright. That gap is exactly what interviewers at consulting firms and Indian GCC identity teams are probing for.
Quick answer: SailPoint BeanShell and rules interview questions test four things: whether you can name the main SailPoint IdentityIQ (IIQ) rule types and say where each one fires, whether you know that a rule is a reusable standalone object while a script is embedded in the object that uses it, whether you have debugged a rule that silently did nothing, and whether you know what SailPoint's published rule guidelines prohibit. The 30 questions below are grouped in the order a real interview runs — definitions, rule types, debugging, best practice, then scenarios.
If you need the underlying concepts rather than the questions, read our SailPoint IIQ rules and BeanShell explainer first — this post deliberately does not re-teach them. For the wider interview, see the SailPoint IIQ interview questions guide and the scenario-based interview questions. Rules are Module 6 of the 14-module SailPoint IIQ course curriculum.
What BeanShell and rules questions does every SailPoint interview open with?
Every SailPoint IdentityIQ (IIQ) interview opens with definitions: what BeanShell is, what a rule is, how a rule differs from a script, and which arguments every rule receives. Answer each in two sentences and name the objects involved. Interviewers use these eight questions to decide how deep they can go next.
1What is BeanShell, and why does SailPoint use it?
BeanShell is a lightweight scripting language with Java-like syntax. SailPoint's developer documentation states that rules are written in Java BeanShell because it gives implementers familiar Java syntax without a compile-and-deploy cycle, while still calling the SailPoint API directly.
2What is a rule in SailPoint IdentityIQ?
A rule in SailPoint IdentityIQ is a standalone object containing BeanShell logic that executes at a defined point in the product. Because it is a separate object, many applications, tasks and workflows can reference the same rule.
3What is the difference between a rule and a script?
SailPoint's documentation is explicit: scripts are embedded inside the object that uses them, while rules are separate objects referenced by the objects that use them. Two applications can share one Build Map rule; a script cannot be reused that way.
4What arguments does an IdentityIQ rule receive?
Most SailPoint IdentityIQ rules receive context (the SailPointContext used to query and save objects) and log (the logger), plus type-specific arguments such as identity, account, application, plan or state.
5How is a rule created in IdentityIQ?
Two ways: through the IdentityIQ rule editor in the UI, or by importing a Rule XML object. Production teams almost always import XML, because only then is the rule version-controlled and promotable between environments.
6What does the rule type attribute actually control?
The type determines which IdentityIQ dropdown lists the rule appears in, and which input variables and return value it is given. Setting the wrong type is the single most common reason a newly written rule never appears in the field you expected.
7Can one rule call another rule?
Yes. In SailPoint IdentityIQ, a rule library referenced from the rule definition is the standard way to share helper methods. Interviewers ask this to test maintainability thinking, not syntax — copy-pasting forty lines into six rules is the wrong answer.
8What is a rule library?
A rule library is a rule object that holds reusable methods other rules import rather than execute directly. Mature SailPoint IdentityIQ deployments typically keep one library per domain, for example a joiner-mover-leaver helper library and a logging library.
Which SailPoint IIQ rule types will you be asked to name?
Interviewers ask candidates to name four to six SailPoint IdentityIQ rule types and say exactly where each one fires. The reliable set is Connector/Build Map, Correlation, Creation, IdentityAttribute, Provisioning and Certification rules. IdentityIQ ships with dozens of rule types, so naming a handful precisely beats listing many vaguely.
| Rule type | Where it fires | What the interviewer is checking |
|---|---|---|
| Connector / Build Map | While the connector reads raw data from the source | That you know it runs before the account object exists in IIQ |
| Correlation | During aggregation, linking an account to an identity | Whether you would use config-based correlation first |
| Creation | When aggregation creates a brand-new identity | That you can separate "link" from "create" |
| IdentityAttribute | During identity refresh, calculating an attribute | Whether you understand refresh ordering |
| Before / After Provisioning | Around the write-back to the target system | Whether you can modify a provisioning plan safely |
| Certification | During certification campaign generation | Whether you know configuration filters often replace it |
9Which runs first, a connector rule or an aggregation rule?
The connector rule runs first. It shapes raw source data as the connector reads it, before SailPoint IdentityIQ builds the account object; aggregation-stage rules then act on the resource object that results. Getting this order wrong is a common rejection point.
10When would you write a correlation rule instead of attribute-based correlation?
Only when the match cannot be expressed as a field-to-field mapping — for example, matching on a normalised employee ID, falling back to email, then to a legacy payroll number. If one attribute pair matches cleanly, use configuration, not code.
11What does an IdentityAttribute rule do?
An IdentityAttribute rule calculates the value of an identity attribute during identity refresh in SailPoint IdentityIQ, typically deriving a value from one or more account links. It is the rule type most often used to build department, location or cost-centre attributes.
12What is the difference between a Before Provisioning and an After Provisioning rule?
A Before Provisioning rule modifies the provisioning plan before it reaches the target system — adding a default attribute, for example. An After Provisioning rule runs once the result is back, and is used for logging, notification or follow-up actions.
13What is a Build Map rule used for?
A Build Map rule transforms the raw row a connector reads — typically from a delimited file or JDBC source — into the map SailPoint IdentityIQ uses to create the account. Splitting a full name or normalising a date format is the classic example.
14Name a rule type SailPoint has deprecated.
Certification Exclusion rules, Identity Selector rules and Integration rules are deprecated on SailPoint's cloud platform, which recommends campaign filters, role assignment criteria and Before Provisioning rules instead. Mentioning a deprecation shows you read current documentation, not a 2019 tutorial.
Write real rules before the interview, not during it
Module 6 of our 14-module SailPoint IdentityIQ program is Application Rules — Aggregation, Provisioning, Connector, Schema and Manage Access — taught live with guided hands-on labs. Attend a free 60-minute live demo before you decide. No payment, no commitment.
How do interviewers test SailPoint rule debugging?
Rule debugging questions separate candidates who have read about SailPoint IdentityIQ (IIQ) from candidates who have run it. The interviewer describes a rule that completes without error and changes nothing, then watches how you narrow it down: wrong rule type, logging level, a null object, or a rule that was never attached at all.
15A rule runs but nothing happens. Where do you look first?
Confirm the rule is attached to the object you believe it is attached to, then confirm the rule type matches the execution point, then raise the logging level for that logger and re-run the task against a single test identity. Attachment and type account for most cases.
16Why do BeanShell stack traces often hide the real error?
When Java code invoked from BeanShell throws an exception, the BSF layer wraps the message and drops the inner stack trace. The SailPoint Developer Community blog post "Better BeanShell Debugging in IdentityIQ" (August 2024) documents this behaviour in the BeanShellBSFEngine class.
17How should you log from inside a rule?
Use log.debug(), log.info(), log.warn() and log.error() at the correct severity. SailPoint's published rule guidelines prohibit System.out statements, because internal log aggregators do not collect them, and prohibit declaring your own logger inside a rule.
18What is the most common exception in SailPoint rules?
A NullPointerException caused by assuming an object exists. SailPoint's rule guidelines state plainly that objects can be null and that null checks are required. Quoting that guideline is a stronger answer than saying you would wrap everything in try/catch.
19How do you test a rule without running a full aggregation?
Run it against one account or identity — a filtered aggregation task, a single-identity refresh, or the IdentityIQ console. Saying you always test on a filtered subset before a full run is the sentence that signals real production experience.
20What should error handling inside a rule look like?
try, catch and finally blocks that let exceptions propagate as intended rather than swallowing them. SailPoint calls this out specifically for connector-executed rules, where a silently swallowed exception makes a connector look healthy while source data quietly goes missing.
What rule best-practice questions come up at senior level?
Senior SailPoint IdentityIQ interviews move from "can you write a rule" to "should you write a rule". Expect questions on rule performance, cache bloat, what SailPoint's rule review blocks outright, and when a configuration feature is the better answer than custom BeanShell. These five questions cover that ground.
21Why is iterating over all identities inside a rule a bad idea?
Because loading full objects in a loop causes cache bloat and degrades the whole task. SailPoint's guidance is to use a projection query that fetches only the columns you need and to return values, rather than materialising large lists of accounts or identities.
22What code is actually banned in SailPoint cloud and connector rules?
SailPoint publishes an explicit blocked list that includes .toXml(), System.out, Thread, Thread.sleep(), .printStackTrace and direct context lookups such as getObjectById(), which must be replaced with Rule Utility helper methods.
23Is a rule always the right answer?
No. SailPoint's own documentation tells implementers to consider rule usage a last resort and to use product features wherever possible, because rules are treated as customer-owned configuration — SailPoint supports the platform, not the logic you put inside the rule.
24What happens to a rule before it reaches a SailPoint cloud tenant?
It goes through SailPoint's rule review, which carries a published 24-hour SLA, with roughly 65% of reviews completed in under four business hours. Customer-hosted SailPoint IdentityIQ has no such gate, which is precisely why IIQ rule discipline is your own responsibility.
25How do you keep rules maintainable across a multi-year deployment?
Version the rule XML in source control, keep shared logic in rule libraries, name rules by application and purpose, never log full object serialisations, and put the execution point in a comment header so the next engineer knows when the rule fires.
What scenario questions do interviewers ask about SailPoint rules?
Scenario questions describe a broken production situation and ask what you would change. Consulting firms and Indian GCC identity teams favour them because they cannot be answered from a memorised list. These five recur in SailPoint IdentityIQ (IIQ) developer and senior developer interviews in 2026.
26After a merger, the HR feed creates duplicate identities. Rule or configuration?
Start with correlation configuration and data quality: is the shared key actually unique across both populations? Only write a correlation rule if the match genuinely needs fallback logic. Then remediate existing duplicates deliberately — never by re-running aggregation and hoping.
27Provisioning succeeds in IIQ but the account never appears in the target. What now?
Check the provisioning result on the identity request, then the connector logs, then whether a Before Provisioning rule altered the plan. A plan that was modified into something the target silently rejects is the classic cause of a green status with no account.
28Contractor entitlements must be stripped 30 days after end date. Rule, lifecycle event or role?
Prefer a lifecycle event driven by the end-date attribute, with role assignment logic doing the removal. A rule belongs here only for the date arithmetic. Interviewers are checking whether you reach for configuration before code.
29A Build Map rule works in development and fails in production. Why?
Almost always data, not code: a field present in every test row is missing or differently formatted in production, and the rule assumes it exists. Environment-specific application configuration and unhandled nulls are the two answers worth giving.
30You inherit 140 undocumented rules. What is your first week?
Export every rule to XML into source control, map each rule to the object that references it, flag orphans that nothing calls, and identify the rules that run inside aggregation loops. You cannot safely change any of them before that inventory exists.
How should you answer a "write a rule on the spot" question?
When a SailPoint interviewer asks you to write a rule live, they are watching your sequence, not your syntax. Nobody expects compiling BeanShell on a whiteboard. State the rule type, state the inputs you expect, write the null check before the logic, and say out loud what you would log — in that order.
- Name the rule type first. "This is an IdentityAttribute rule, so it runs during identity refresh and returns a value." That one sentence tells the interviewer you know where the code will execute.
- State your inputs. Say which arguments you expect —
identity,context,log— before writing a line. It shows you know rule signatures vary by type. - Write the null check before the logic. Handle the missing-object case first. SailPoint's own guidelines require null checks, and doing it unprompted reads as production habit.
- Say what you would log and why. One
log.debug()naming the identity and the computed value, and an explicit note that you would not log sensitive attributes.
// Rule type: IdentityAttribute — runs during identity refresh
if (identity == null) { return null; }
String dept = identity.getStringAttribute("department");
if (dept == null || dept.trim().isEmpty()) {
log.debug("No department for identity: " + identity.getName());
return "UNASSIGNED";
}
return dept.trim().toUpperCase();The honest thing interviewers reward
Saying "I would check the current rule signature in the documentation before writing this" is not a weak answer. Rule arguments differ by type and by IdentityIQ version, and every experienced implementer looks them up. Pretending to remember all of them is the answer that gets caught.
Are BeanShell rules still worth learning in 2026?
Yes — SailPoint IdentityIQ (IIQ) remains widely deployed across Indian BFSI and GCC environments, and Naukri listed 6,164 SailPoint vacancies in India in September 2026. SailPoint Identity Security Cloud (ISC) uses transforms for simple attribute logic, but still runs BeanShell rules in its cloud-executed and connector-executed contexts.
The practical distinction is worth rehearsing, because it is asked directly. Transforms handle declarative attribute manipulation in ISC and are configuration, not code; rules handle logic transforms cannot express, and in ISC they are constrained by the blocked-code list and the rule review process described above. Our SailPoint ISC transforms explainer covers the cloud side in depth, and the IIQ-to-ISC migration skills guide covers why engineers who understand both are in demand.
Who is hiring for these skills: in India, global consulting firms and systems integrators including Deloitte, Accenture, Infosys, Wipro and TCS, alongside BFSI global capability centres such as HSBC and JP Morgan. In the United States, SOX, HIPAA and FedRAMP compliance obligations keep identity governance demand high across banking and consulting. In the United Kingdom, UK GDPR and FCA requirements drive the same demand in financial services. SailPoint IdentityIQ developer roles in India typically advertise 3–8 years of IT experience with Java or scripting exposure, according to job listings observed on Naukri in September 2026.
On salary figures
Any salary range you read for SailPoint rule-writing roles is a market estimate, not a guarantee — pay depends on prior experience, employer, location and interview performance. International salary figures are market estimates from public job listings and salary aggregators, and vary by employer, location, experience and individual negotiation. Our SailPoint IIQ salary in India 2026 guide sets out the sourced bands by role.
One genuine observation from teaching this module: the candidates who struggle in rule interviews are rarely the ones who cannot code. They are the ones who learned rules from blog snippets and never watched a rule fire inside a running aggregation. A September 2026 thread on the SailPoint Developer Community asked exactly this — a candidate preparing for mid-level IdentityIQ roles wrote that they had read the interview guides and asked ChatGPT, but wanted to know whether those questions actually get asked. The answer is that the questions do, but the follow-up does not: interviewers ask what you saw in the log afterwards. That is the part only a live environment teaches, which is why Module 6 in our live online SailPoint IIQ course is taught with guided hands-on labs by a trainer with 15 years of enterprise IAM experience, alongside mock interviews and IAM career path guidance. Placement assistance and career guidance are provided; jobs are never guaranteed, and the programme awards a SailPoint Academy certificate of completion, not an official SailPoint certification.
If coding is the part you are unsure about, read does SailPoint require coding and, if you already write Java, Java developer to SailPoint IIQ developer. For the roles above this one, see the SailPoint IIQ architect interview questions. SailPoint Academy publishes these guides from what students are actually asked.
Frequently Asked Questions
These are the questions IT professionals most often ask about SailPoint BeanShell and rules interviews — drawn from Google People Also Ask results, the SailPoint Developer Community, and questions students raise in SailPoint Academy live sessions.
Answer Rule Questions From Experience, Not From a List
Live online SailPoint IdentityIQ training — Rs. 25,000 flat, 2 months, all 14 modules, batch capped at 25, guided hands-on labs, recordings in the LMS, mock interviews and placement assistance. Attend a free 60-minute demo first. No payment. No commitment.