> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ravenna.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# IGA/IAM overview
> Understand how Ravenna helps organizations implement Identity Governance and Administration (IGA) and Identity and Access Management (IAM) processes.
Identity Governance and Administration (IGA) and Identity and Access Management (IAM) are the foundation of secure access control in modern organizations. Ravenna provides a comprehensive platform to implement these processes through an integrated approach combining workflows, AI agents, tickets, and application management.
***
## What is IAM?
Identity and Access Management (IAM) focuses on ensuring the right people have access to the right resources at the right time. IAM systems handle user authentication, authorization, and the ongoing management of digital identities throughout their lifecycle.
Create, modify, and deactivate user accounts across systems
Grant and revoke permissions based on roles and policies
Verify user identities before granting access
Determine what resources users can access
***
## What is IGA?
Identity Governance and Administration (IGA) builds on IAM by adding governance, compliance, and audit capabilities. IGA ensures that access decisions are documented, reviewed, and aligned with organizational policies and regulatory requirements.
Regular reviews of who has access to what
Automated enforcement of access policies and rules
Complete documentation of access requests and changes
Evidence of proper access controls for auditors
***
## JML and access lifecycle management
Identity governance covers the entire employee lifecycle: joiners, movers, and leavers (JML). Organizations typically need to manage two types of access:
**Birthright access** - Baseline permissions automatically granted based on role, department, or location. This access should be managed through your identity provider (Okta, Google Workspace) using group rules that apply access as employee attributes change.
**Just-in-time (JIT) access** - Ad hoc or incremental access requests that fall outside standard birthright access. These are project-based needs, temporary responsibilities, or exceptions that require approval and audit trails.
Ravenna focuses on just-in-time access requests, providing the workflow, approval, and automation layer for access that requires human decision-making. For birthright access managed by your identity provider, Ravenna can trigger onboarding workflows and coordinate provisioning for applications not managed through SSO.
```mermaid theme={"system"}
%%{init: {'theme':'base', 'themeVariables': { 'primaryColor':'#e3f2fd','primaryTextColor':'#000','primaryBorderColor':'#1976d2','lineColor':'#666','secondaryColor':'#f3e5f5','tertiaryColor':'#e8f5e9'}}}%%
flowchart LR
%% Styling
classDef hris fill:#fce4ec,stroke:#c2185b,stroke-width:2px
classDef okta fill:#e3f2fd,stroke:#1976d2,stroke-width:2px
classDef ravenna fill:#f3e5f5,stroke:#7b1fa2,stroke-width:2px
classDef app fill:#e8f5e9,stroke:#388e3c,stroke-width:2px
classDef group fill:#fff9c4,stroke:#f9a825,stroke-width:2px
classDef workflow fill:#fce4ec,stroke:#c2185b,stroke-width:2px
classDef birthrightBox fill:#e3f2fd,stroke:#1976d2,stroke-width:3px
classDef jitBox fill:#e8f5e9,stroke:#388e3c,stroke-width:3px
%% Identity Creation Flow
HRIS[New Employee in HRIS]:::hris
OktaUser[User Created in Okta]:::okta
HRIS --> OktaUser
%% Birthright Access Path
subgraph Birthright["BIRTHRIGHT ACCESS"]
direction TB
Groups[Group Rules Apply]:::okta
AllEmployees[All Employees]:::group
Engineering[Engineering]:::group
Manager[Manager]:::group
Groups --> AllEmployees
Groups --> Engineering
Groups --> Manager
AllEmployees --> App1[Google, Slack, Notion]:::app
Engineering --> App2[GitHub, Claude Code]:::app
Manager --> App3[Lattice, Ashby]:::app
end
OktaUser -->|"Okta"| Groups
linkStyle 1 stroke:none,fill:none
%% JIT Access Path
subgraph JIT["JUST-IN-TIME ACCESS"]
direction TB
Ravenna[Onboarding Ticket Created]:::ravenna
Actions[Workflow Actions]:::workflow
Form[Send Form to Hiring Manager]:::workflow
SlackAdd[Add to Slack Channels & Groups]:::workflow
GoogleAdd[Add to Google Groups]:::workflow
Ravenna --> Actions
Actions --> Form
Actions --> SlackAdd
Actions --> GoogleAdd
Form --> Tickets[Create Child Tickets for Manual Apps]:::workflow
end
OktaUser -->|"Ravenna"| Ravenna
linkStyle 2 stroke:none,fill:none
class Birthright birthrightBox
class JIT jitBox
```
***
## How Ravenna supports IGA/IAM
Ravenna provides an integrated platform that brings together multiple capabilities to support complete IGA/IAM processes. Rather than requiring separate tools for each aspect of identity governance, Ravenna combines workflows, AI, ticketing, and application management into a unified system.
### Applications
Define your application catalog with granular access levels that reflect how your organization actually uses each tool. Map access levels to identity provider groups for automated provisioning, and configure approval strategies for different permission tiers.
Learn about [applications](/documentation/manage-access/applications) and access level configuration
### Workflows
Automate the entire access request lifecycle from submission through approval and provisioning. Build approval logic that routes requests based on application, access level, and organizational policies. Integrate with identity providers like Okta and Google Workspace to provision access automatically after approval.
**Common workflow patterns:**
* Route approval requests based on application risk level
* Require multiple approvals for privileged access
* Automatically provision access after approval
* Send notifications to requesters and approvers
* Create audit trails of all access decisions
Learn about [workflows](/documentation/automate/workflows/overview) for access automation
### Agents
Deploy AI agents that help users request access through natural language conversations. Agents can gather required information, pre-fill forms, and trigger workflows automatically based on what users describe they need. This reduces friction in the access request process while maintaining proper governance controls.
**How agents help:**
* Users describe what they need in plain language
* Agents ask clarifying questions to gather details
* Forms are pre-filled with the right information
* Workflows execute automatically with proper approvals
Learn about [agents](/documentation/automate/agents/overview) for conversational access requests
### Tickets
Every access request becomes a ticket that provides complete audit trails and collaboration capabilities. Tickets document who requested access, why they need it, who approved it, when it was provisioned, and any related communications. This creates the paper trail needed for compliance and security reviews.
**Ticket capabilities:**
* Complete history of every access request
* Collaboration between requesters and approvers
* Status tracking from request through provisioning
* Integration with workflows for automation
* Searchable records for audit and compliance
Learn about [tickets](/documentation/tickets/channels) and access request tracking
***
## Building an IGA/IAM process
Implementing IGA/IAM with Ravenna involves defining your application catalog with access levels, creating request forms, building approval workflows, and integrating with your identity provider for automated provisioning.
Follow the [Setting up access requests](/guides/how-to/setting-up-access-requests) guide for complete step-by-step instructions
## Mental model
Ravenna's IGA/IAM support is built on top of existing platform primitives. There is no separate "IGA module." Instead, applications, forms, workflows, tickets, and agents combine to create access governance processes.
| Ravenna primitive | IGA/IAM function |
| ----------------- | ---------------------------------------------------------------------------------------------------------- |
| **Applications** | Access catalog. Defines what tools exist and what permission tiers are available. |
| **Access levels** | Permission tiers within an application (e.g., Admin, Editor, Viewer). Map to IdP groups for provisioning. |
| **Forms** | Access request intake. Collect application, access level, justification, and other required information. |
| **Workflows** | Approval and provisioning automation. Route approvals, enforce policies, provision access via IdP actions. |
| **Tickets** | Audit trail. Every access request is a ticket with full history of who requested, who approved, and when. |
| **Agents** | Conversational access requests. Users describe what they need, and the agent presents the right form. |
***
## Birthright vs just-in-time access
Ravenna focuses on **just-in-time (JIT) access**, not birthright access.
**Birthright access** is baseline access granted automatically based on role, department, or location. This should be managed in your identity provider (Okta, Google Workspace, Microsoft Entra ID) using group rules that apply access as employee attributes change. Ravenna does not manage birthright access directly.
**Just-in-time access** is ad hoc or incremental access that falls outside standard birthright grants. These requests require human decision-making, approval workflows, and audit trails. This is where Ravenna operates.
For the **joiner** phase of JML, Ravenna can complement birthright access by triggering onboarding workflows when a new employee is detected (via IdP webhook or HRIS event). These workflows can coordinate provisioning for applications not managed through SSO, send forms to hiring managers, create child tickets for manual provisioning steps, and add users to Slack channels or Google Groups.
***
## Building an access request process
Recommended sequence for implementing JIT access requests:
1. **Define applications and access levels.** Create your application catalog in Ravenna. For each application, define the permission tiers users can request. Map access levels to IdP groups where possible.
2. **Create access request forms.** Build forms with custom fields for application select, access level select, and business justification. Use the application select and access level select field types to connect forms to your catalog.
3. **Build approval workflows.** Create workflows triggered by form submission. Route approvals based on the application and access level requested. Use assignment strategies (Auto, All, Round Robin) configured on each access level.
4. **Add provisioning actions.** After approval, use Okta or Google Workspace workflow actions to automatically add users to the appropriate groups or applications.
5. **Configure agent rules.** Train the agent to recognize access requests in conversation and present the appropriate form. Reference forms with `@Form Name` in agent rules.
6. **Deploy and monitor.** Publish workflows, test the end-to-end flow, and monitor ticket analytics for approval times and bottlenecks.
***
## Constraints and gotchas
* Ravenna handles JIT access requests, not birthright access. Birthright access should be managed in your identity provider.
* Automated provisioning requires an active integration with Okta or Google Workspace. Without an IdP integration, provisioning must be done manually after approval.
* Access levels are defined per application. There is no global "role" concept that spans multiple applications. If a user needs access to multiple applications, each requires a separate access level selection (or a workflow that provisions multiple applications in sequence).
* The application catalog is organization-scoped, but workspace visibility is configurable. Each application can be surfaced in specific workspaces via request forms.
* Audit trails are inherent. Every access request is a ticket, so all approvals, denials, and provisioning actions are automatically recorded.
* Access revocation is not automated by default. Ravenna handles the request and provisioning side. For revocation, you need separate workflows or IdP-managed access reviews.