Workforce IAM · JML Governance

HRIS to entitlements,
SCIM-bridged, audit-chained.

15 synthetic people across joiner / mover / leaver buckets · 6 pipeline anomalies (orphan keys, over-privileged movers, SCIM lag, Day-1 errors) · 8 connector health rows · ed25519-signed audit chain bridging Workforce events and Identity events.

7Joiners (last 30d)Workday → IdP active flow
4Movers (last 30d)internal role changes
4Leavers (last 30d)offboard pipeline
3Orphan accountsleavers still in IdP/SaaS

JML pipeline — MomentumHR Inc.

15 synthetic people across joiner / mover / leaver buckets. Each row shows the HRIS event date, days-since-event, the provisioning narrative (Workday → Okta → entitled apps), and current status. 3 orphan accounts + 1 over-privileged mover currently flagged.

PersonJMLDepartmentRoleHRIS eventPipelineStatus
Aisha TenderoJoinerMarketingSenior PMM2026-05-28
Day 1
Workday → Okta → 4 appsCurrent
Brendan CoatesworthJoinerEngineeringStaff Engineer2026-05-30
Day -1 (delayed)
Workday provisioned, Okta pendingIdP lag
Carla ReevesMoverSales → Customer SuccessVP CS2026-05-25
Day 3
Okta groups updated, app entitlements 6/8In progress
Daniel PhamLeaverEngineeringSr. SRE (terminated)2026-05-26
T+7d
Okta disabled, 2 apps orphanedOrphan
Eva HendricksJoinerFinanceSr. FP&A2026-05-29
Day 2
Workday → Okta → 6 appsCurrent
Felipe MarchandMoverEngineering → PlatformPrincipal Eng2026-05-20
Day 8
Old groups still attached (over-priv)Over-privileged
Gianna VolkovLeaverMarketingLead PMM (resigned)2026-05-22
T+11d
Fully deprovisioned, all apps confirmedComplete
Hiroshi NakamuraJoinerSalesEnterprise AE2026-05-31
Day 0
Workday created, Okta pending, no appsIdP lag
Ines MarchettiMoverOperations → People OpsSr. People Partner2026-05-15
Day 13
Approvals stalled (manager OOO)Stalled
Jules OkaforJoinerEngineeringSr. Security Eng2026-05-30
Day -1
Workday provisioned, security review pendingIn progress
Kim PelletierLeaverSalesAE (terminated)2026-05-24
T+9d
Slack still active (orphan #3)Orphan
Luca BerkowitzJoinerCustomer SuccessSr. CSM2026-05-28
Day 1
Standard provision completeCurrent
Maya FerreiraMoverFinance → Strategic FinanceDirector2026-05-26
Day 7
Entitlements aligned, MFA reconfirmedCurrent
Nikhil RoyJoinerEngineeringStaff DevOps2026-06-02
Day 0
Workday created todayCurrent
Olivia StrandLeaverEngineeringSr. PM (offboarded)2026-05-18
T+15d
Personal AWS access keys still activeOrphan

Pipeline anomalies — 6 patterns surfaced

SCIM 2.0 does most of the work, but the gaps that survive are exactly the gaps audit findings live in: orphan accounts (personal keys, Slack lag), over-privileged movers (old groups retained), stalled approvals (single-approver fragility), and Day-1 lag (SCIM UserAlreadyExists on rehires/contractor-conversions).

Orphan account — terminated leaver

Daniel Pham still in 2 SaaS apps

Daniel Pham (terminated 2026-05-26) is disabled in Okta but retains active sessions in Slack and AWS console (personal access key AKIA...XY42 last used 6h ago). Auto-deprovision didn't fire because tokens were issued before Okta SCIM webhook. Force-revoke now.

SOX ITGCISO 27001 A.9.2.6Orphan
Orphan account — terminated leaver

Olivia Strand AWS keys still active

Olivia Strand (offboarded 15 days ago) has personal IAM access keys still tagged active in AWS. SCIM doesn't deprovision personal keys — manual revocation required. CIS Control 6.4 violation.

CIS Control 6.4Orphan15-day gap
Orphan account — terminated leaver

Kim Pelletier Slack still active

Kim Pelletier (terminated 2026-05-24) — Slack workspace still shows active member (Slack SCIM bridge has known 72-hour lag). Manually deactivate. Validate the SCIM job ran.

SCIM lagOrphanSlack
Over-privileged mover

Felipe Marchand retains old Engineering groups

Felipe Marchand moved Engineering → Platform 8 days ago but still has old Engineering Okta groups (eng-sre, eng-incident, eng-deploys). New Platform groups added without removing old. SOX SoD requires role-transition cleanup within 5 business days.

SOX SoDOver-privStale groups
IdP provisioning lag

Brendan Coatesworth Day -1 (delayed)

Brendan Coatesworth Workday hire-date was yesterday but Okta provisioning is still pending. Day-1 productivity blocker. SCIM job logs show UserAlreadyExists error (orphan from prior contractor stint). Manual merge required.

SCIM errorDay-1 blocker
Stalled approval — Mover

Ines Marchetti waiting 13 days

Ines Marchetti moved Operations → People Ops 13 days ago. Manager-of-new-role is OOO; access-review approval stalled. ISO 27001 A.9.2.5 requires periodic re-validation — but blocking on a single OOO manager is process-fragile. Recommend backup approver in the workflow.

Process gapISO 27001 A.9.2.5

SCIM connector health

SCIM 2.0 (RFC 7644) is the standard provisioning protocol. Healthy connectors sync within minutes; lag warnings fire at 1-hour, escalate at 24-hour. Personal access keys (AWS, GitHub PATs, etc.) are NOT covered by SCIM — manual revocation is the only path, which is where orphans accumulate.

ConnectorProtocolPending changesLast syncStatus
Workday → OktaSCIM 2.0+2 added (Daniel removed too late)8h agoOperational, 1 lag warning
Okta → SlackSCIM 2.01 deprovision pending (Kim Pelletier)72h delay (known)Lagging
Okta → SalesforceSCIM 2.0All synced12m agoHealthy
Okta → GitHubSCIM 2.0All synced23m agoHealthy
Okta → AWS SSOSAML + SCIMPersonal keys NOT covered by SCIM1h agoPartial — manual gap
Okta → DatadogSCIM 2.0All synced8m agoHealthy
Okta → SnowflakeSCIM 2.0All synced2h agoHealthy
Okta → 1PasswordSCIM 2.0All synced44m agoHealthy

Workforce ↔ Identity audit chain

Two co-mingled event streams: workforce.event.* (HRIS-side) and identity.* (IdP-side). When they synchronize cleanly, no human-readable report is needed. When they drift, the gap IS the audit finding.

Audit chain · Workforce → Identity event chain. ed25519-signed per event, prior_hash field makes log tamper-evident.
2026-06-02T15:01:33Zworkforce.event.terminateDaniel Pham · termination effective T+7d…f81c39
2026-06-02T15:00:08Zidentity.deprovision.completedOkta — Daniel Pham disabled…a4220e
2026-06-02T14:55:21Zidentity.orphan.detectedAWS personal key — Daniel Pham still active…e7d011
2026-06-02T14:48:02Zworkforce.event.role_changeFelipe Marchand · Engineering → Platform…b3cc88
2026-06-02T14:46:11Zidentity.entitlement_grantedFelipe Marchand · platform-deploys group…7a55f1
2026-06-02T14:32:44Zworkforce.event.hireBrendan Coatesworth · Staff Engineer, eng-platform…55d2a2
2026-06-02T14:31:59Zidentity.provision.failedOkta — UserAlreadyExists (Brendan, prior contractor)…1009bc
2026-06-02T13:45:00Zworkforce.event.hireAisha Tendero · Senior PMM, marketing…4f8d33

Why this surface exists

The hardest part of identity governance is not the IdP itself — it's the seam between HRIS (Workday, UKG) and IdP (Okta, Entra ID), and the further seam to apps that bypass SCIM (personal access keys, legacy SAML, manual provisioning). This surface visualizes both seams in one view so the gaps that become audit findings stop hiding.

Buyer: HR Ops · IT Identity teams · Compliance (SOX / Sarbanes / ISO) running access-review cycles · Internal audit during quarter-close.

Regulatory anchors: SOX ITGC · ISO 27001 A.9.2 · NIST 800-53 AC-2/PS-4/PS-5 · GDPR Art 32 · CCPA · SCIM 2.0 (RFC 7644).

KG Suite tie-back: Every operator decision on this surface emits an audit-stream event (hash-chained, ed25519-signable). Vault-contract data classification follows the Decision Card v0.3 pattern (data_vault_targets + retention_envelope). Incident escalations match the AI Incident Card profile shape. Evidence bundles align with the AI Evidence Format spec.

Static-only doctrine: No backend. No login. No telemetry. All synthetic data is baked into this HTML page as JavaScript constants. Nothing leaves the tab. Frame as readiness / evidence / posture / controls / scaffolding — never "compliant" or "certified" without an externally-attested audit.