> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ravenna.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# IGA/IAM overview

> Understand how Ravenna helps organizations implement Identity Governance and Administration (IGA) and Identity and Access Management (IAM) processes.

Identity Governance and Administration (IGA) and Identity and Access Management (IAM) are the foundation of secure access control in modern organizations. Ravenna provides a comprehensive platform to implement these processes through an integrated approach combining workflows, AI agents, tickets, and application management.

## Mental model

Ravenna's IGA/IAM support is built on top of existing platform primitives. There is no separate "IGA module." Instead, applications, forms, workflows, tickets, and agents combine to create access governance processes.

| Ravenna primitive | IGA/IAM function                                                                                           |
| ----------------- | ---------------------------------------------------------------------------------------------------------- |
| **Applications**  | Access catalog. Defines what tools exist and what permission tiers are available.                          |
| **Access levels** | Permission tiers within an application (e.g., Admin, Editor, Viewer). Map to IdP groups for provisioning.  |
| **Forms**         | Access request intake. Collect application, access level, justification, and other required information.   |
| **Workflows**     | Approval and provisioning automation. Route approvals, enforce policies, provision access via IdP actions. |
| **Tickets**       | Audit trail. Every access request is a ticket with full history of who requested, who approved, and when.  |
| **Agents**        | Conversational access requests. Users describe what they need, and the agent presents the right form.      |

***

## Birthright vs just-in-time access

Ravenna focuses on **just-in-time (JIT) access**, not birthright access.

**Birthright access** is baseline access granted automatically based on role, department, or location. This should be managed in your identity provider (Okta, Google Workspace, Microsoft Entra ID) using group rules that apply access as employee attributes change. Ravenna does not manage birthright access directly.

**Just-in-time access** is ad hoc or incremental access that falls outside standard birthright grants. These requests require human decision-making, approval workflows, and audit trails. This is where Ravenna operates.

For the **joiner** phase of JML, Ravenna can complement birthright access by triggering onboarding workflows when a new employee is detected (via IdP webhook or HRIS event). These workflows can coordinate provisioning for applications not managed through SSO, send forms to hiring managers, create child tickets for manual provisioning steps, and add users to Slack channels or Google Groups.

***

## Building an access request process

Recommended sequence for implementing JIT access requests:

1. **Define applications and access levels.** Create your application catalog in Ravenna. For each application, define the permission tiers users can request. Map access levels to IdP groups where possible.

2. **Create access request forms.** Build forms with custom fields for application select, access level select, and business justification. Use the application select and access level select field types to connect forms to your catalog.

3. **Build approval workflows.** Create workflows triggered by form submission. Route approvals based on the application and access level requested. Use assignment strategies (Auto, All, Round Robin) configured on each access level.

4. **Add provisioning actions.** After approval, use Okta or Google Workspace workflow actions to automatically add users to the appropriate groups or applications.

5. **Configure agent rules.** Train the agent to recognize access requests in conversation and present the appropriate form. Reference forms with `@Form Name` in agent rules.

6. **Deploy and monitor.** Publish workflows, test the end-to-end flow, and monitor ticket analytics for approval times and bottlenecks.

***

## Constraints and gotchas

* Ravenna handles JIT access requests, not birthright access. Birthright access should be managed in your identity provider.
* Automated provisioning requires an active integration with Okta or Google Workspace. Without an IdP integration, provisioning must be done manually after approval.
* Access levels are defined per application. There is no global "role" concept that spans multiple applications. If a user needs access to multiple applications, each requires a separate access level selection (or a workflow that provisions multiple applications in sequence).
* The application catalog is organization-scoped, but workspace visibility is configurable. Each application can be surfaced in specific workspaces via request forms.
* Audit trails are inherent. Every access request is a ticket, so all approvals, denials, and provisioning actions are automatically recorded.
* Access revocation is not automated by default. Ravenna handles the request and provisioning side. For revocation, you need separate workflows or IdP-managed access reviews.