who
Canonical person, employment context, and manager chain.
Platform capability
See who, what, and why — then govern the correction
Investigate identity reach across connected domains, explain authorization with temporal context, and route findings into governed remediation where paths are declared.
Illustrative workflow — not a live product screenshot. Scope and coverage apply.
Coverage depends on connected sources and declared remediation paths. Full-estate visibility is not implied.
Subject type
Employees, contractors, partners
Who / What / Why cockpit
Illustrative product view — subject types do not imply identical underlying data.
what
Group, role, and entitlement reach with last-change timeline.
why
Live grant contributors: birthright, request, SoD exception, policy.
who
Canonical person, employment context, and manager chain.
what
Group, role, and entitlement reach with last-change timeline.
why
Live grant contributors: birthright, request, SoD exception, policy.
Identity data ingestion and correlation
Identity data ingestion and correlation
Source families feed correlation; the graph retains provenance and uncertainty states.
Correlation and ownership resolution
Normalized identity graph
Not labeled “complete identity” — states reflect correlation quality.
- Correlated
- Probable match
- Unresolved
- Conflicting authority
Select a link to view source system and collection time (illustrative).
Legend
- Identity and context
- Policy and decision
- Evidence and proof
What this diagram shows
- Connected source families feed correlation and ownership resolution.
- The normalized graph preserves correlated, probable, unresolved, and conflicting links.
- Provenance is available on focus; completeness depends on connected sources.
Findings hub
Illustrative product view — prioritization separates consequence from confidence.
Triage states: New · Investigating · Acknowledged · Suppressed · False positive · Remediation proposed · Verified closed
| Finding | Subject | Consequence | Reason | Confidence | Coverage | Change time | State |
|---|---|---|---|---|---|---|---|
| Standing privilege on agent tool path | FinanceCloseAssistant | External payment field change without step-up | Delegation broader than mission | High | MCP gateway connected | Last 24h | Investigating |
| Orphaned service identity | LegacyServiceAgent | Unknown API scope with standing reference | Owner unresolved | Medium | Partial — graph conflict | Stale signal | New |
| SoD exception nearing expiry | AP Clerk (human) | Create vendor + approve payment overlap | Time-bound exception | High | IGA connected | 7 days | Remediation proposed |
Temporal explanation
Temporal explanation
Before and after reach for one change event, with a contributor chain explaining why access changed.
Previous reach
- • ERP read
- • Board materials folder
Role assignment added: Finance Approver
New reach
- • ERP read
- • Board materials folder
- • Payment approval API
Before
- ERP read
- Board materials folder
Role assignment added: Finance Approver
After
- ERP read
- Board materials folder
- Payment approval API
Why changed
- Authoritative HR role change
- Graph entitlement projection
- Policy evaluation at next action
- New reachable effect class
Legend
- Identity and context
- Policy and decision
- Execution
What this diagram shows
- Change event: Role assignment added: Finance Approver.
- Reach before: ERP read, Board materials folder.
- Reach after: ERP read, Board materials folder, Payment approval API.
- Contributor chain: Authoritative HR role change → Graph entitlement projection → Policy evaluation at next action → New reachable effect class.
Closed-loop remediation
Remediation moves from a recorded finding, through a proposed correction with its blast radius shown, to authorization, a governed job that performs the change, verification against the target, and the evidence left behind. Each step is illustrative and depends on connected sources and a configured workflow.
Stage 1 of 6 — Identity and context
Finding recorded with confidence and coverage
Consequence and reason code stored; no automatic remediation.
- Requires connected sources and configured workflow.
Requires connected sources and configured workflow.
Stage 2 of 6 — Policy and decision
Suggested correction with blast-radius preview
Expected reduction in reachable effects; reversibility stated.
- Illustrative — governed workflow where configured.
Illustrative — governed workflow where configured.
Stage 4 of 6 — Execution
Mediated change through execution boundary
Credentials and dispatch held outside investigator context.
- Illustrative — declared execution paths only.
Illustrative — declared execution paths only.
Stage 5 of 6 — Evidence and proof
Independent read-back where connector supports it
Otherwise marked reconciliation required — not success.
- Coverage-dependent.
Coverage-dependent.
Stage 6 of 6 — Evidence and proof
Closed-loop proof export
Finding linked to decision, job, and verified outcome.
- Illustrative — export where connectors and retention are configured.
Illustrative — export where connectors and retention are configured.
Remediation preview (illustrative)
- Action
- Remove Finance Approver role from mission delegation
- Reach removed by this action
- Reach removed by this action (qualitative — not a calculated score)
- Approver / authority
- Finance Ops owner
- Reversibility
- Reversible via standard access request
- Affected target
- Mission delegation object
- Verification
- Graph read-back after job completion
Neighbor comparison
Each column states what that category optimizes for and what it does not alone provide.
| Capability | IGA | PAM | NHI tooling | SIEM / SOC | Identity Intelligence |
|---|---|---|---|---|---|
| Optimized use case | Lifecycle, certification, SoD | Session and vault control | Machine identity inventory | Detection and investigation | Cross-domain who/what/why + governed fix |
| Does not alone provide | Live action-time authorization proof | Full entitlement graph across SaaS | Human-agent correlation at action | Authoritative remediation execution | Universal estate coverage without connectors |
Specialization by tooling category — not a product ranking.
Optimized use case
- IGA
- Lifecycle, certification, SoD
- PAM
- Session and vault control
- NHI tooling
- Machine identity inventory
- SIEM / SOC
- Detection and investigation
- Identity Intelligence
- Cross-domain who/what/why + governed fix
Does not alone provide
- IGA
- Live action-time authorization proof
- PAM
- Full entitlement graph across SaaS
- NHI tooling
- Human-agent correlation at action
- SIEM / SOC
- Authoritative remediation execution
- Identity Intelligence
- Universal estate coverage without connectors
Five tooling categories side by side, stating what each optimizes for and what it does not alone provide. IGA optimizes for lifecycle, certification and separation of duties, and does not alone provide live action-time authorization proof. PAM optimizes for session and vault control, and does not alone provide the full entitlement graph across SaaS. NHI tooling optimizes for machine identity inventory, and does not alone correlate a human to an agent at the moment of action. SIEM and SOC tooling optimizes for detection and investigation, and does not alone carry out authoritative remediation. Identity Intelligence optimizes for cross-domain who, what and why with a governed fix, and does not alone provide universal estate coverage without connectors.
Visibility without intelligence produces dashboards. Intelligence without visibility produces theory.
Get Started
Connect once. Govern consistently. Change safely.
Request Demo See the platform in action
Talk to an Expert Technical consultation
