Identity Governance
Keymate Identity Governance keeps each person's access matched to their current job, from the day they join to the day they leave. Joiners, movers and leavers come from your HR system today, through API-based connectors. Access reviews are on the roadmap.
How Identity Governance differs from a full governance suite
Classic identity governance and administration solutions offer certification campaigns, segregation of duties and access request catalogs. Keymate Identity Governance starts smaller: the lifecycle of the accounts Keymate already holds. If you need a full suite, Keymate runs beside it: the suite governs who holds which entitlement, and Keymate decides and records what each request may do.
What identity lifecycle management covers
Identity lifecycle management means creating, changing and removing accounts as a person's situation changes. User provisioning creates and changes them. To deprovision is to remove an account and its access, the part auditors check most.
- Birthright access is what everyone in a role or department gets on day one, without a request.
- Orphaned accounts belong to people who have left. They appear when deprovisioning depends on someone remembering.
Today, accounts and organization memberships in Identity change through Keymate's API, from the system that owns your user list.
Joiners, movers and leavers from HR events
Joiner, mover and leaver automation turns HR events into account changes. A new hire gets birthright access. A move between departments swaps one set of roles for another. A leaver loses access the moment HR records the leave. Keymate does this today: an API-based connector, set up for your HR system, sends each hire, move and leave to Keymate, which applies it. There is no ready-made connector catalog; each connector is set up for the HR system you run.
Access reviews (on the roadmap)
An access review is a periodic check, by a manager or an application owner, that each person still needs the access they hold. Access reviews are on the roadmap for Identity Governance. Keymate does not run certification campaigns today.
How Identity Governance connects to the rest of the platform
- Identity holds the accounts and organizations whose lifecycle this module is built to manage.
- Authorization decides what each account may do once it exists.
Further reading
- What is identity and access management: the four jobs of an IAM system, and why access piles up at the mover step, not the leaver step.
Questions
How do I run an access certification campaign?
Pick a scope (an application, a department or a set of sensitive roles), send each reviewer the list of people and access in it, and ask them to keep or remove each item by a deadline. Remove what was rejected, and keep the decisions as evidence for your auditor. Keymate does not run certification campaigns today; access reviews are on the roadmap for Identity Governance.
Which IAM platforms integrate with HR systems?
Check whether the platform has a ready-made connector for each of your HR systems, one that turns a hire, a move or a leave into account changes. Identity governance suites and many workforce IAM platforms offer these connectors. Keymate has no ready-made connector catalog: it connects to HR systems through API-based connectors set up for the HR system you run.