Corporate project · In development
IAM/IGA
Identity governance platform under development, designed to bring lifecycle, access grants, access origin, risk and auditing together in a single experience. Real corporate integrations are not enabled yet.
- Status
- In development
- Category
- Security · Identity · Governance
- Environment
- Development, with fictitious data
Interactive demo with synthetic data
Explore the prototype
A fictitious person, the path of every access and the reason it exists. Everything runs here, with no server and no real data.
- Click a block on the map to open the Inspector with the item’s details.
- In Paths, pick an access and follow its origin back to the person, with the explanation.
- Open Identity 360 from the People list and go back to the map with the same selection.
- On a phone, use the full-screen icon in the corner to see the map larger.
Overview by category. Click an item for details.
On a phone, use two fingers to zoom.
Context
In corporate environments, identity and access information is usually spread across directories, HR systems, applications, groups, support tools, legacy databases, manual approvals and spreadsheets.
That makes it hard to govern: finding all of a person’s access, understanding where each one comes from, knowing who approved it, tracking joiners and leavers, reviewing privileges, detecting Segregation of Duties conflicts and explaining an access to auditors.
Who holds what, why, who authorised it, and what is the risk?
Governance chain
The product is designed to link the authoritative source to audit in a single chain, and the experience shows not only what exists, but why it exists. Today provisioning and connectors run only in a simulation environment, with external writes disabled.
- Authoritative source
- Identity
- Lifecycle
- Policies and roles
- Desired access
- Approval and governance
- Provisioning
- Connector
- Target system
- Reconciliation
- Audit, risk and certification
Architecture
Identity source and lifecycle
Identities, accounts and the joiner, mover and leaver lifecycle, from an authoritative source.
Policies and governance
Business roles, policies, requests and approvals. Risk and Segregation of Duties conflicts are assessed in the backend.
Access plan
Desired access, planned action and provisioning orchestration, kept apart from execution.
Connectors
Connector framework with write guards and a safe mode. Today only simulated connectors; AD, Entra ID and others are planned.
Simulated, real disabledReconciliation and audit
Compares desired with found access, surfaces drift and records audit, risk and certification.
Cross-cutting
Backend authorisation
Profiles, permissions and capabilities decided in the backend; the interface never authorises.
Audit and explanation
Every access carries its origin and who requested, approved and assigned it, to answer why it exists.
Security and SoD
External writes blocked, safe mode on and role-conflict assessment.
Conceptual diagram of what is documented; it does not represent active corporate integrations.
Security and backend first
The interface never decides authorisation: the backend is the source of truth for profiles, permissions, lifecycle, approvals, policies, provisioning, reconciliation, risk, SoD and audit.
Intent, execution and reconciliation kept apart
Access intent, planned action, execution, outcome and observed state are distinct concepts. Reconciliation compares desired with found and surfaces drift.
Decoupled connectors
The flow to the target system is prepared for simulated connectors, with write guards and a safe mode. Real connectivity was deliberately postponed.
Concepts that never blur
Technical profile, business role, entitlement, account, application, policy and access origin are modelled separately, as are who requested, approved, assigned and provisioned.
Technologies
- Backend and APIs
- Data and persistence
- Interface and visualisation
- Execution and containers