What you can do
Build your application catalog
Sync applications from your identity provider, or add them by hand for tools outside it.
Define access levels
Set the permission tiers people can request for each application.
Define access policies
Control who can request access, who approves, how long it lasts, and whether a justification is required.
Choose how access is provisioned
Change IdP groups or Okta assignments automatically, or route the grant to a person.
Track entitlements
Monitor active grants, extend or revoke them, and respond to provisioning failures.
Enable agent-assisted requests
Let your AI agent help users find eligible applications, submit requests, and renew expiring access in Slack.
How it works
A user requests access to an application through a form or the AI agent. Ravenna checks the access policy to confirm the user is eligible, then routes the request to the approvers in the policy’s approval template. Once the request is approved, Ravenna runs the access level’s provisioning method: it changes a group membership or Okta app assignment in your identity provider, or asks a person to grant the access.What happens inside the application depends on your identity provider and the application. Ravenna doesn’t create accounts in applications. Removing a group membership stops new sign-ins through SSO where the group controls the app, and it deactivates the account only if the IdP’s provisioning does that. See group membership is not an application account.
Coming from a tool that creates accounts through each application’s own API? Ravenna’s automated methods work through your identity provider instead. Ravenna changes the group or assignment, and the IdP or the application creates and deactivates the account. Check which of your applications have provisioning set up in your IdP, and use Manual for the rest.
Key concepts
- are the tools you manage access to. They’re synced from a connected identity provider or created manually for tools outside it, including tools teams adopted without IT. Both kinds get the same request flow and audit trail.
- Access levels are the permission tiers within an application, such as Viewer, Editor, or Admin. Each has its own policy and provisioning method.
- set eligibility by group, the approval template, allowed durations, and whether a business justification is required. A level with no policy is auto-approved.
- Provisioning methods decide what Ravenna changes after approval: Group (IdP group membership), Application (Okta app assignment), or Manual (a person grants access). The Workflow method doesn’t provision yet.
- record each grant: who has which level, its status, its expiry, and how it was granted and revoked.
Where Ravenna fits in your identity stack
Ravenna doesn’t replace your identity provider. Your IdP handles sign-in, birthright access from group rules, and, where you’ve set it up, creating and deactivating accounts in applications. Ravenna adds the request, approval, and audit layer for access that falls outside birthright rules: project needs, temporary access, and exceptions that need a human decision.For joiners, movers, and leavers, Ravenna can run onboarding and offboarding workflows and keeps a record of who has what. See the employee lifecycle playbook.
Getting started
1
Import or create applications
Sync your catalog from your identity provider, or add applications manually for tools outside your IdP.
2
Create approval templates
Define who approves access and in what order at Settings > Approvals. Policies reference these, so build them first.
3
Create access policies
Set eligibility, allowed durations, and justification requirements, then attach the approval template that should route requests.
4
Define access levels
Set up permission tiers for each application, attach an access policy to each, and choose a provisioning method.
5
Build the request form
Create one form with application and access level select fields. Eligibility filtering tailors it to each requester automatically.
6
Enable agent-assisted requests
Turn on Software Access Requests in your agent’s Identity tab under Advanced Settings so users can request access through Slack. See software access requests for agents.
Follow the full setting up access management guide for step-by-step instructions