Product — available today
Identity governance for estates that have been running for a decade
Discovery first: what access exists, who holds it, and what — if anything — approved it. Everything else in the product depends on getting that right.
01 Discovery
Read the estate the way the directory reads it
Effective access is not what the group names suggest. It is what resolves after nesting, inheritance, direct grants and the objects that survived a migration. The platform resolves it, then puts a state against every step of the chain.
Group state — one container, four states
- OU=Groups,DC=corp,DC=example
- Approved. SEC-Finance-Payments-RW
- No approval record. SEC-Ops-Shared
- No approval record. SEC-Contractor-Onboard-2019
- Orphaned. SEC-Project-Cygnet
-
- Approved. SEC-Helpdesk-Tier2
- Orphaned. GG-Legacy-Domain-Admins-Old
-
- Approved, with a record
- No approval record
- Orphaned or leaver
The last row is the one that ends a conversation with an auditor: a legacy group with three members, nested into Domain Admins, with nothing anywhere that says who agreed to it. It is not exotic. Almost every estate of this age has one.
02 Capabilities
What the product does, in depth
-
01
Golden record
One identity, assembled from the systems that each hold part of it — the HR record, the on-premises AD object, the Entra ID object, the mailbox, the accounts that were created directly in the cloud and never linked to anything. Where those disagree, the disagreement is shown rather than silently resolved in favour of whichever source was read last.
-
02
Intersection-based role baselining
Rather than asking a workshop to design roles on a whiteboard, take everyone who holds the same job and intersect the access they actually have. The overlap is the evidence-backed proposal for the role. What falls outside it is the exception list, and it is short enough that someone will read it. Roles built this way describe the organisation you have, not the one on the org chart.
-
03
Group state visualisation
Every group carries a state, and the state is the colour: approved with a record, approved but unowned, no approval record, orphaned. The nesting is drawn as nesting. An IT director can scan a container and see where the debt sits without reading a single row of a table.
-
04
Audit revert
Every change the platform makes is recorded with the actor, the time, the before state and the reason, and every change can be reversed from that record. The reversal is itself recorded. Nothing is undone quietly, which is the property an auditor actually cares about.
-
05
Hybrid AD and Entra ID
Both directories are read as one estate, including the parts that do not line up: cloud-only accounts that were never joined to an on-premises object, objects whose sync has been failing since a migration, groups that exist on one side and not the other. Those mismatches are usually where the oldest access debt is hiding.
-
06
Multi-tenant by design
Several legal entities, brands or acquired companies under one IT function, each with its own directory and its own auditor, viewed separately or together. Tenant separation is at the data layer, not a filter applied in application code that one bad query could bypass.
03 Lifecycle
Joiners, movers and leavers, driven by the HR record
Lifecycle automation is only as good as its treatment of the middle case. Most tools handle joiners well, leavers adequately and movers not at all.
- Joiner
- A record appears in the HR system. The account, the mailbox and the role-appropriate group memberships are created from the role baseline, before the first day rather than during it. What the baseline does not cover is raised as a named exception with an approver attached, not granted quietly.
- Mover
- The hardest of the three, and the one most tools skip. When someone changes role, the access belonging to the old role is removed as the new access is added. Accumulation is the default failure mode of every manual process and it is the reason a ten-year employee ends up with more access than the CTO.
- Leaver
- Disabling the sign-in is the start, not the end. Group memberships are removed, direct grants are revoked, delegations are stripped, and the hybrid counterpart object is handled rather than left behind. The whole removal is one recorded, reversible transaction.
Every lifecycle action runs through the same recorded, reversible transaction model as any other change. If a role change removes access someone needed, the fix is a revert with a reason, not a frantic manual re-grant that nobody writes down.
04 Boundaries
What it does not do
Worth stating plainly, because you will find out in week two anyway.
-
Not a PAM tool
It shows you who holds privileged group membership and what approved it. It does not broker sessions, vault credentials or issue just-in-time elevation. If you need privileged access management, buy a privileged access management product.
-
Not an IdP
Entra ID stays your identity provider. The platform governs what the directory grants; it does not authenticate your users or sit in the sign-in path.
-
Not a SIEM
It records access state and every change to it. It is not where you send your firewall logs, and it will not alert you on a brute-force attempt.
-
Not a data classifier
It knows that a group grants write access to a share. It does not read what is in the files, and it does not want to.
Bring a directory you are worried about.
The demo runs on synthetic data by default. If you would rather see your own estate, a read-only scoped trial takes about a day to stand up and the agent never writes anything.