Identity & access
Employee access, joined to the identity layer.
Where you already run our identity and access platform, the connection is closer: role-based access defined here can drive the grants there, with every change still approved by a person.
What connects
A two-way connection between the role and access model here and the identity layer's grants, so a role change produces a proposed set of permission changes rather than a manual list.
What crosses the boundary
- Received: current grants, groups and sign-in activity per identity.
- Received: application inventory, so the access record names real systems.
- Sent: proposed grant and revocation changes, each requiring human approval.
- Sent: leaver events, which propose revocation and never execute it unattended.
What this lets you do
- Turn a role change into a reviewed set of access changes in one step.
- Close the loop on offboarding: propose, approve, revoke, confirm, record.
- Keep the access record exact rather than approximately right.
- Evidence an access review with the grants as they actually stood.
Setting it up
- 1Link the two workspaces from either side; both must be administered by you.
- 2Map roles here to permission sets there, one at a time rather than in bulk.
- 3Run in proposal-only mode until the mapping is right.
- 4Enable approved changes, with approval required for every revocation.
Permissions
Scoped to the applications you map. Nothing is granted or revoked without a named person approving it, and every automated proposal is recorded with the rule that produced it.
What you can ask once this is connected
- “What access would this role change add and remove?”
- “Which grants exist that no role accounts for?”
- “Confirm every revocation for last month's leavers.”
Where it stops
This is the deepest connection available and it is still approval-gated. Nothing revokes access automatically on a date, because an incorrect automatic revocation during a working week is worse than a delayed manual one.
Run your team with clarity.
From the moment someone joins to the day their responsibilities are handed over, Orglume keeps your people, their work and your organization connected.
Set up from a spreadsheet · Nothing about the AI is metered · [email protected]