Sheet POR-03 · Identity Manual
Governance, Lifecycle & Audit
Access packages, requests and approvals, joiner-mover-leaver workflows, access reviews and audit.
Access packages
An access package groups the access a team or job needs. People request packages, approvers approve them, and reviewers certify them. A package is one of four types: Birthright, Requestable, Eligible or Review-only.
Birthright packages are granted automatically when HR or profile data says a person qualifies. Keep approval for access that needs a decision, such as admin rights or sensitive data.
Requests and approvals
People request packages from My Access. An approval policy decides who must approve: nobody, any one approver, a set number, or everyone listed. A policy can route requests to the application owner. Approvers see a fixed snapshot of the request and any separation-of-duties conflict.
Joiners, movers and leavers
Lifecycle workflows run from an HR feed or an HR system connector such as Workday. Joiners get an account and their birthright packages. Movers lose packages that no longer match their new job. Leavers lose all tenant access on the next import after the feed marks them as terminated.
Access reviews
Reviewers keep or remove each item in a campaign. A campaign closes only when every item is decided and the removals are done.
Audit and access explanations
The access graph shows how a person got a given access: through which application, group, role, request or grant. From an application, role or group you can export a CSV of everyone who holds it and how. The audit log records each export, along with every administrative and access change.
Use in other Cadres products
- Meridian uses Portal review results, grants and audit records as evidence for access controls.
- Relay and Keystone access is granted and removed through Portal like any other application.
Checks during a trial
- Change a test user’s department and confirm their dynamic groups update.
- Suspend a test user. Confirm their sessions end and the audit log shows your reason.
- Try to demote a tenant’s last super user and confirm Portal refuses.
- Connect your identity provider, run a routing simulation, then sign in as a test user.
- Request a package as a test user, approve it, and find the grant in the access graph.
- Run a small review campaign and export the results.