See the blast radius
before you save.
Birthright access declared as rules — "every employee in IT gets the AppHub IT group" — built with pickers, simulated live, and enforced by reconciliation.
Visual policy builder
Conditions with pickers, not JSON.
Three questions, one preview. Edit a condition and it says: matched 93, will match 111 — here are the 18 who start and the 0 who stop, by name and business id. Flip a policy from off to on and it is the same preview, from zero. Pause one and it is the same preview, to zero. And it always names what that population actually gets, because "nineteen identities gain access" is not a sentence you can approve.
- Live simulation: "93 of 509 identities matched", listed by name — and by business id
- It is also how you switch on a starter pack: they install inert, and the flip from off to on is a preview like any other — from zero to N, named
- Pickers bound to your real data — departments, functions, entitlements
- Time-bound policies with tenant-configurable validity presets
Policies that stay true
Reconciliation keeps reality aligned with the rule.
A policy isn't a suggestion: reconciliation continuously compares the declared access against what exists, grants what's missing (gated if you want), and flags what shouldn't be there.
- Every policy-granted item carries the policy it came from — and the day the policy stops matching, the access goes with it
- Drift from the rule surfaces in the control center with the fix attached
- Policies can also grant accounts themselves — "every employee gets an AD account"
- The warning is keyed on what disappears, not on what changes: reconciliation pulls back what stops matching, on a clock, without asking again. A narrowed condition, a switched class and a pause are the same event to the person losing access
See a policy simulated on your own data.
A 30-minute kickoff connects your HR feed and one system — working POC the same day.
Bring your HR feed plus one system you trust us to read — that is all the kickoff needs. No NDA, no second call with a sales engineer, no procurement form.