What's inside
Two cert flows. One reconciliation engine. One audit chain.
Periodic reviews catch slow drift on a calendar. Event-triggered smart certs catch fast change as it happens. Reconciliation surfaces unauthorised grants the moment they appear on a target. The audit chain ties everything together with cryptographic integrity.
Campaign-based access reviews with KPIs
See what's waiting on reviewers right now, what's overdue, and campaign-by-campaign progress. Spawn ad-hoc campaigns from any cert-rule or let the continuous sweep handle it automatically.
Per-target-kind rules — grant / role / policy / identity
Different review cadences for different subjects: grants every 180 days, privileged grants every 90 days, business roles yearly, NHI ownership every 6 months. Each rule has its own reviewer chain (multi-step + quorum) and auto-action on deadline (revoke, disable, flag-for-review).
"Something changed — review now"
When an identity transfers between departments, a smart cert fires for the new manager to confirm existing access. When a new grant lands, an optional 30-day grant-review fires. Distinct from periodic certs — different task type, different routing, both auditable.
What should be granted vs what is granted
SOL (should-be access) is the calculated baseline from policies + roles. IST (actual access) is what the recon engine reads off the target. Drift falls into three buckets: unapproved grants (someone has more than they should), missing grants (they should have it but don't), and attribute drift (HR-leading attributes diverge on target).
Per-identity drift surfaced as work items
Each identity gets a "warnings" view — derived from SOL-vs-IST plus other compliance signals. Operators can take action directly: re-grant the missing entitlement, request revoke for the unapproved one, or approve as a justified exception with audit trail.
Declare toxic combinations, not just within one app
Cross-system SoD rules let you declare conflicting capabilities across different connected applications: "vendor maintenance in Workday" vs "payment approval in SAP". The advisor flags every identity holding both sides — and the risk-score weight scales by severity (critical, warning).
Continuous SoD detection across the population
Beyond preflight at grant-time, the toxic-combo scanner sweeps the existing population for SoD pairs that emerged via aggregation: someone got "payment requester" from role A and "payment approver" from role B. Surface, route to compensating control, or revoke.
SOX, ISO 27001, HIPAA, GDPR — one click each
Framework-mapped evidence packs: pick a date range, hit "Generate + download" and you get a ZIP with HTML index, per-section data files, and a manifest. Pre-built templates for SOX § Access Management, ISO 27001 Annex A.9, HIPAA § 164.312, and GDPR Art. 32 — each mapped to the specific controls your auditor will ask about.
