One platform.
Read through six different jobs.
Identity governance touches everyone differently: the IAM lead lives in it, the CISO answers for it, compliance evidences it, managers decide in it, the CIO pays for it and the architect signs off on it. Same product below — six honest readings of what it changes for you.
For the IAM / IT lead
Your week stops being a ticket queue.
You own the joiner tickets, the AD groups and the leaver checklist nobody finishes. RapidValue connects HR and your targets in a guided wizard, and lifecycle automation takes the repetitive work — with every write batch-gated for your approval until you trust it.
- Connector wizard: schema auto-discovery, suggested mappings, live endpoint test at every step
- App mining names the applications hiding in your AD group families — and opens the app-onboarding wizard already filled in
- Joiners, movers and leavers driven by the HR feed — not by tickets
- Training wheels: provisioning on, writes queued for your batch approval per system
- Day one is audible too: a new joiner's login invite goes out with the sync on password tenants — no per-person admin click
- Failed provisioning lands in a triage queue with a structured reason — retry is gated on a config fix. Each failure class carries its own size, trend and owner, so a queue that is quietly growing shows up as a finding instead of as a tab nobody opens
For the CISO
"Who has access to what" gets a real answer.
One sync gives you the access reality across systems; the analytics layer turns it into priorities you can defend in front of the board: a deterministic risk score per identity, cross-system toxic combinations, and the non-human identities nobody owned until now.
- Risk score over 18 explainable components, 16 of which score — no black box, breakdown per identity
- Cross-system SoD: toxic combinations declared once, flagged wherever they occur
- Shadow access surfaced: permissions inherited through nested groups
- Break-glass with coverage tracking — emergency access that is visible, time-boxed and reviewed
- Your SOC does not have to log into ours. The security events — a failed sign-in, a brute-force cool-down, a lockout, a kill switch, an emergency activation, a new critical risk — leave over an outbound webhook you point wherever you collect them, picked in one click as a preset rather than assembled event by event. Be clear about what that is: a webhook, not a vendor integration. You get an optional HMAC-SHA256 signature and a delivery log that keeps the real reason per attempt — refused, timed out, DNS, TLS, 4xx, 5xx — which your security team can read without being an admin and without ever seeing the endpoint or its secret. Failed-login bodies name only a reason class on purpose, so the feed cannot be turned into a user-enumeration oracle
- Findings that answer themselves: when an owner changes, their pending decisions move at that moment — and a question that has already been settled closes itself, with the reason on the trail
- At 02:00 the security team can act, not just see: lock a compromised person out (the dialog states the blast radius first — how many accounts and grants go dark, and you acknowledge it), revoke a live privileged session, and close the emergency-access review with a verdict on the record. The overrides carry a written reason, because an override without one is not evidence. Killing a rogue AI agent was already theirs; now the human variant of the same emergency is too
For compliance, audit & the DPO
The audit is in six weeks? Good.
Evidence isn't a quarterly scramble here — it's a by-product of how the platform runs. Every reconciliation records a per-grant reason, the audit trail is hash-chained and database-immutable, and framework packs generate from live data.
- Audit packs — SOX · ISO 27001 · HIPAA · GDPR Art. 32 · DORA Art. 9 · NIS2 Art. 21 · SOC 2 CC6 · EU AI Act / ISO 42001 agent governance, plus lifecycle and privileged-access evidence — one click, framework-cited sections
- A report now opens as a view — the auditor's question gets an answer on screen before it becomes a file — and the evidence pack carries its own verifier inside the ZIP: your external auditor checks the signature with a published key and nothing from us
- Access reviews: continuous, campaign and event-triggered (a transfer spawns one now, not next quarter)
- Reconciliation evidence per grant: "expected via policy X" / "not expected — flagged"
- GDPR Art. 20 self-service export and Art. 17 erasure, with the legal-retention carve-out done right
For the business manager
Review your team's access — in your language.
You shouldn't need to know what "CN=SG-FIN-APP-RW" means to do your part. Your team's access is spelled out in business language, approvals are one click, and when you're out, your queue is delegated — with every on-behalf decision visibly badged. And the mail that tells you there is something waiting — an approval or a review round — can carry the link straight to it. One link, never an Approve button next to a Reject button in a mailbox — per tenant, and off by default. What you leave waiting reminds you by itself.
- My team: who has what, in plain words — keep · flag · revoke per line
- Requests route through approval chains someone designed visually — you just decide
- People ask for "Jira — Engineering", not SG-APP-JIRA-ENG-RW: once an app is onboarded from a mining proposal, its raw groups stop being individually requestable
- Reconciliation drift lands in the same inbox, itemised — Keep it or Remove it, never a blanket approve-all
- Role proposals arrive as business stories: "12 people in Finance share this access"
- Out-of-office delegation keeps the chain moving without losing who actually decided
- A department owner gets a standing cockpit — members, pending decisions with due dates, conflicts, running reviews and this month's movement — not a yearly spreadsheet
- And the direction of travel, not only today's list: three lines over the last ninety days — the team's average risk, the share of people holding something dormant, and the open work sitting with you. Somebody nobody has scored yet is left out of the average instead of counted as a zero, so the line says what it actually measured
For the CIO / budget owner
Prove the value before you spend the budget.
The classical IGA proposal asks for a year of licence and services before you see your own data. Here the sequence is inverted: a working POC on your data in a day, go-live as a gradient instead of a big-bang, and one platform with everything included — no add-on modules.
- Day 1: connect + see your own access reality — decide on evidence, not slides
- One platform, everything included — no per-module pricing surprises
- Day one is configured, not blank: four starter packs (birthright, JML, access review, SoD) install inert, so you edit governance instead of authoring it
- No mandatory integrator programme — the guided product does the heavy lifting; partners accelerate where you want them
- An honest, written list of where the incumbents are still ahead — before you commit
For the architect / security engineer
You'll run the security review anyway. We wrote it for you.
The tier-3 agent dials out over HTTPS :443 — no inbound ports, no VPN tunnel — and resolves connector credentials locally: secrets never cross the wire to the control plane. You register it, watch it heartbeat, and see exactly which version each host is running. It's one readable Python file plus the connector code the control plane serves it — signed, and code only, never secrets.
- Outbound :443 only, to a published IP allowlist — no inbound ports, no VPN tunnel, SSRF-guarded task execution
- ECDSA P-256 keypair challenge-response — the private key is generated on the host and never leaves it
- Credentials in a local encrypted vault, or your own — HashiCorp · Azure Key Vault · AWS Secrets Manager — where we store the reference and your vault keeps the value
- Updates are pushed and Ed25519-signed against a pinned key; "if this agent died" shows you what would strand, and you re-point its connectors to a replacement
- Audit trail hash-chained and immutable at the database level — tampering is detectable
- The agent watches itself: life is a completed round trip, and if it misses the deadline it set for itself it restarts. If it cannot, the silence is a finding with a name on it, not an empty dashboard
- EU control plane, Belgian company, no US parent — sovereignty by construction, running today
Whichever job is yours
See your own access patterns this afternoon.
A working POC on your HR feed and one target system, in a day. Walk-away clean if it doesn't convince you.