It makes sense to have one tile per application in HelloID. That one tile is connected to one group. Requesting access via the tile makes me (when request is approved) member of that group. Being member of that group enables me to make use of the application.

However, within the applications there might be different privilege levels, each level providing access to different functionalities in the applications. If we want to enable the user to request access to such privilege levels, currently that would only be possible by create multiple tiles in HelloId.

You can image that many different tiles representing different privileges levels for one application clutters HelloId, confuses the users and offers a non-optimal user experience.

Proposed solution:

Allow the user to activate checkboxes in the request form of the application access request. Each checkbox representing a privilege/functionality in the application. We know this option is available when requesting an application but when returning the product this becomes problematic, because the deprovisioning flow can not determine which permissions have to be cleared.