[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ADYFBKFPBBFJGQRQRG8VQ9":3,"skill-same:01M6ADYFBKFPBBFJGQRQRG8VQ9":150},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":41,"linkOnly":42,"markdownContent":43,"markdownBody":44,"frontMatter":45,"refName":89,"commitSha":90,"skillDirectory":91,"forksCount":92,"repositoryHtmlUrl":93,"repositoryHomepageUrl":94,"ownerHtmlUrl":95,"ownerBlogUrl":96,"ownerDescription":97,"updatedAt":98,"install":99,"resources":112},"01M6ADYFBKFPBBFJGQRQRG8VQ9","building-identity-governance-lifecycle-process",null,"Design identity governance and lifecycle (IGA) programs on platforms like SailPoint, Saviynt, or Entra ID Governance, covering joiner-mover-leaver (JML) automation, role mining, access requests, periodic recertification, and orphaned-account remediation sourced from an HR feed. Use when automating cross-system JML provisioning, remediating former-employee access, or building lifecycle processes for SOX, HIPAA, or GDPR compliance.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-identity-governance-lifecycle-process\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40],"building identity governance lifecycle process","identity","governance","compliance","IGA","access-provisioning","JML","lifecycle-management","identity-governance","hipaa","gdpr","design","pr","rbac","entra id","automation","cybersecurity","2026-11-10 10:12:30",false,"---\nname: building-identity-governance-lifecycle-process\ndescription: Design identity governance and lifecycle (IGA) programs on platforms like SailPoint, Saviynt, or Entra ID Governance, covering joiner-mover-leaver (JML) automation, role mining, access requests, periodic recertification, and orphaned-account remediation sourced from an HR feed. Use when automating cross-system JML provisioning, remediating former-employee access, or building lifecycle processes for SOX, HIPAA, or GDPR compliance.\ndomain: cybersecurity\nsubdomain: identity-access-management\ntags:\n- identity-governance\n- lifecycle-management\n- JML\n- access-provisioning\n- RBAC\n- IGA\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_ai_rmf:\n- GOVERN-1.1\n- GOVERN-1.7\n- MAP-1.1\nnist_csf:\n- PR.AA-01\n- PR.AA-02\n- PR.AA-05\n- PR.AA-06\nmitre_attack:\n- T1098\n- T1136\n- T1078\n- T1531\n- T1087\nmitre_f3:\n  version: '1.1'\n  tactics:\n  - positioning\n  - defense-impairment\n  - initial-access\n  techniques:\n  - id: F1005\n    name: Account Manipulation\n    tactic: positioning\n    source: f3\n  - id: F1005.002\n    name: 'Account Manipulation: Add Authorized User'\n    tactic: positioning\n    source: f3\n  - id: F1033\n    name: Insider Access Abuse\n    tactic: initial-access\n    source: f3\n  - id: F1042\n    name: Reactivate Account\n    tactic: positioning\n    source: f3\n  - id: F1006\n    name: Account Takeover\n    tactic: initial-access\n    source: f3\n---\n\n# Building Identity Governance Lifecycle Process\n\n## When to Use\n\n- Organization lacks automated joiner-mover-leaver (JML) processes for identity management\n- Access provisioning is manual and takes days, creating productivity loss and security gaps\n- Former employees retain access to systems after termination (orphaned accounts)\n- Role explosion has created thousands of roles with unclear ownership and overlapping entitlements\n- Compliance requirements mandate documented identity lifecycle processes (SOX, HIPAA, GDPR)\n- No centralized visibility into who has access to what across the enterprise\n\n**Do not use** for single-application user management; identity governance addresses cross-system lifecycle management requiring correlation of authoritative HR sources with downstream application provisioning.\n\n## Prerequisites\n\n- Authoritative HR system (Workday, SAP SuccessFactors, BambooHR) as identity source of truth\n- IGA platform (SailPoint, Saviynt, One Identity) or Microsoft Entra ID Governance\n- Active Directory and\u002For Azure AD as primary directory services\n- Application connectors for target systems requiring automated provisioning\n- Defined organizational role structure and reporting hierarchy\n- Stakeholder buy-in from HR, IT, security, and business unit managers\n\n## Workflow\n\n### Step 1: Define Identity Lifecycle States and Transitions\n\nMap the identity lifecycle from hire to termination:\n\n```python\n\"\"\"\nIdentity Lifecycle State Machine\nDefines all identity states and valid transitions with automated actions.\n\"\"\"\n\nIDENTITY_LIFECYCLE = {\n    \"states\": {\n        \"PRE_HIRE\": {\n            \"description\": \"Identity created from HR feed before start date\",\n            \"automated_actions\": [\n                \"Create identity record in IGA platform\",\n                \"Generate unique employee ID\",\n                \"Create mailbox reservation\",\n                \"Assign birthright roles based on job code\",\n                \"Initiate background check workflow\"\n            ],\n            \"valid_transitions\": [\"ACTIVE\", \"CANCELLED\"]\n        },\n        \"ACTIVE\": {\n            \"description\": \"Employee has started, full access provisioned\",\n            \"automated_actions\": [\n                \"Create Active Directory account\",\n                \"Create email mailbox\",\n                \"Provision birthright application access\",\n                \"Assign department-specific roles\",\n                \"Add to distribution groups\",\n                \"Issue MFA token\u002Fsecurity key\",\n                \"Create VPN account if remote worker\"\n            ],\n            \"valid_transitions\": [\"ROLE_CHANGE\", \"LEAVE_OF_ABSENCE\", \"TERMINATED\"]\n        },\n        \"ROLE_CHANGE\": {\n            \"description\": \"Employee transferred, promoted, or changed departments\",\n            \"automated_actions\": [\n                \"Recalculate role assignments based on new job code\",\n                \"Remove access from previous department applications\",\n                \"Provision access for new department applications\",\n                \"Update group memberships\",\n                \"Transfer manager in directory\",\n                \"Trigger access review for retained entitlements\",\n                \"Notify new manager of inherited access\"\n            ],\n            \"valid_transitions\": [\"ACTIVE\", \"LEAVE_OF_ABSENCE\", \"TERMINATED\"]\n        },\n        \"LEAVE_OF_ABSENCE\": {\n            \"description\": \"Employee on extended leave (medical, parental, sabbatical)\",\n            \"automated_actions\": [\n                \"Disable interactive login (preserve account)\",\n                \"Suspend VPN access\",\n                \"Set out-of-office auto-reply\",\n                \"Delegate mailbox to manager\",\n                \"Preserve all role assignments for return\",\n                \"Set reactivation date from HR feed\"\n            ],\n            \"valid_transitions\": [\"ACTIVE\", \"TERMINATED\"]\n        },\n        \"TERMINATED\": {\n            \"description\": \"Employee has left the organization\",\n            \"automated_actions\": [\n                \"Disable AD account immediately\",\n                \"Revoke all application access\",\n                \"Revoke VPN and remote access\",\n                \"Convert mailbox to shared (manager access for 90 days)\",\n                \"Transfer OneDrive files to manager\",\n                \"Remove from all security and distribution groups\",\n                \"Revoke OAuth tokens and API keys\",\n                \"Wipe corporate data from mobile devices\",\n                \"Archive identity record\",\n                \"Schedule account deletion after retention period\"\n            ],\n            \"valid_transitions\": [\"REHIRE\", \"DELETED\"]\n        },\n        \"REHIRE\": {\n            \"description\": \"Previously terminated employee returning\",\n            \"automated_actions\": [\n                \"Reactivate existing identity record\",\n                \"Reset credentials and require MFA re-enrollment\",\n                \"Provision based on new job code (not previous access)\",\n                \"Flag for enhanced access review in first 30 days\"\n            ],\n            \"valid_transitions\": [\"ACTIVE\"]\n        },\n        \"DELETED\": {\n            \"description\": \"Account permanently removed after retention period\",\n            \"automated_actions\": [\n                \"Delete AD account\",\n                \"Delete email mailbox archive\",\n                \"Remove identity record from IGA\",\n                \"Generate deletion audit log\"\n            ],\n            \"valid_transitions\": []\n        }\n    },\n    \"retention_periods\": {\n        \"terminated_to_deleted\": \"90 days (default)\",\n        \"mailbox_retention\": \"90 days as shared mailbox\",\n        \"onedrive_retention\": \"30 days manager access, then archived\",\n        \"audit_log_retention\": \"7 years for compliance\"\n    }\n}\n```\n\n### Step 2: Implement Authoritative Source Integration\n\nConnect HR system as the single source of truth for identity data:\n\n```python\n\"\"\"\nHR Source Integration - Workday to IGA Platform Connector\nPolls Workday for employee lifecycle events and triggers provisioning.\n\"\"\"\nimport requests\nfrom datetime import datetime, timedelta\nimport logging\n\nclass WorkdayIdentityConnector:\n    def __init__(self, config):\n        self.base_url = config[\"workday_api_url\"]\n        self.tenant = config[\"tenant\"]\n        self.client_id = config[\"client_id\"]\n        self.client_secret = config[\"client_secret\"]\n        self.session = requests.Session()\n        self.logger = logging.getLogger(\"workday_connector\")\n\n    def get_access_token(self):\n        \"\"\"Authenticate to Workday REST API.\"\"\"\n        token_url = f\"{self.base_url}\u002Fccx\u002Foauth2\u002F{self.tenant}\u002Ftoken\"\n        response = self.session.post(token_url, data={\n            \"grant_type\": \"client_credentials\",\n            \"client_id\": self.client_id,\n            \"client_secret\": self.client_secret\n        })\n        response.raise_for_status()\n        return response.json()[\"access_token\"]\n\n    def fetch_worker_changes(self, since_datetime):\n        \"\"\"Fetch all worker lifecycle events since the last sync.\"\"\"\n        headers = {\"Authorization\": f\"Bearer {self.get_access_token()}\"}\n        params = {\n            \"Updated_From\": since_datetime.isoformat(),\n            \"Updated_Through\": datetime.utcnow().isoformat(),\n            \"Count\": 100\n        }\n\n        workers = []\n        url = f\"{self.base_url}\u002Fccx\u002Fapi\u002Fv1\u002F{self.tenant}\u002Fworkers\"\n\n        while url:\n            response = self.session.get(url, headers=headers, params=params)\n            response.raise_for_status()\n            data = response.json()\n            workers.extend(data.get(\"data\", []))\n            url = data.get(\"next\", None)\n            params = {}\n\n        return workers\n\n    def map_lifecycle_event(self, worker):\n        \"\"\"Map Workday worker data to identity lifecycle event.\"\"\"\n        worker_data = worker.get(\"workerData\", {})\n        employment = worker_data.get(\"employmentData\", {})\n        personal = worker_data.get(\"personalData\", {})\n\n        event = {\n            \"employee_id\": worker.get(\"id\"),\n            \"first_name\": personal.get(\"legalName\", {}).get(\"firstName\"),\n            \"last_name\": personal.get(\"legalName\", {}).get(\"lastName\"),\n            \"email\": worker_data.get(\"emailAddress\"),\n            \"job_code\": employment.get(\"jobProfile\", {}).get(\"id\"),\n            \"job_title\": employment.get(\"jobProfile\", {}).get(\"name\"),\n            \"department\": employment.get(\"organization\", {}).get(\"name\"),\n            \"department_code\": employment.get(\"organization\", {}).get(\"id\"),\n            \"manager_id\": employment.get(\"managerId\"),\n            \"location\": employment.get(\"location\", {}).get(\"name\"),\n            \"cost_center\": employment.get(\"costCenter\", {}).get(\"id\"),\n            \"hire_date\": employment.get(\"hireDate\"),\n            \"termination_date\": employment.get(\"terminationDate\"),\n            \"status\": employment.get(\"status\"),\n            \"worker_type\": employment.get(\"workerType\"),\n        }\n\n        # Determine lifecycle transition\n        if event[\"status\"] == \"Active\" and event[\"hire_date\"]:\n            hire_date = datetime.fromisoformat(event[\"hire_date\"])\n            if hire_date > datetime.utcnow():\n                event[\"lifecycle_event\"] = \"PRE_HIRE\"\n            else:\n                event[\"lifecycle_event\"] = \"JOINER\"\n        elif event[\"status\"] == \"Active\":\n            event[\"lifecycle_event\"] = \"MOVER\"  # Department or role change\n        elif event[\"status\"] == \"Terminated\":\n            event[\"lifecycle_event\"] = \"LEAVER\"\n        elif event[\"status\"] == \"On Leave\":\n            event[\"lifecycle_event\"] = \"LEAVE_OF_ABSENCE\"\n\n        return event\n\n    def process_lifecycle_events(self, since_datetime):\n        \"\"\"Main processing loop for identity lifecycle events.\"\"\"\n        workers = self.fetch_worker_changes(since_datetime)\n        events = []\n\n        for worker in workers:\n            event = self.map_lifecycle_event(worker)\n            events.append(event)\n            self.logger.info(\n                f\"Lifecycle event: {event['lifecycle_event']} for \"\n                f\"{event['first_name']} {event['last_name']} \"\n                f\"(EmpID: {event['employee_id']})\"\n            )\n\n        return events\n```\n\n### Step 3: Implement Role Mining and Birthright Access\n\nDefine roles based on job functions for automated provisioning:\n\n```python\n\"\"\"\nRole Mining Engine\nAnalyzes existing access patterns to derive role definitions\nfor birthright (automatic) provisioning.\n\"\"\"\nimport pandas as pd\nfrom collections import Counter\nfrom itertools import combinations\n\nclass RoleMiningEngine:\n    def __init__(self, access_data):\n        \"\"\"\n        access_data: DataFrame with columns\n        [employee_id, job_code, department, application, entitlement]\n        \"\"\"\n        self.access_data = access_data\n\n    def mine_birthright_roles(self, min_assignment_pct=0.8):\n        \"\"\"\n        Identify entitlements that should be automatically assigned\n        based on job code. If 80%+ of users with same job code\n        have an entitlement, it becomes birthright access.\n        \"\"\"\n        birthright_roles = {}\n\n        for job_code, group in self.access_data.groupby(\"job_code\"):\n            total_users = group[\"employee_id\"].nunique()\n            entitlement_counts = group.groupby(\n                [\"application\", \"entitlement\"]\n            )[\"employee_id\"].nunique()\n\n            birthright_entitlements = []\n            for (app, ent), count in entitlement_counts.items():\n                pct = count \u002F total_users\n                if pct >= min_assignment_pct:\n                    birthright_entitlements.append({\n                        \"application\": app,\n                        \"entitlement\": ent,\n                        \"assignment_percentage\": round(pct * 100, 1),\n                        \"user_count\": count\n                    })\n\n            if birthright_entitlements:\n                birthright_roles[job_code] = {\n                    \"job_code\": job_code,\n                    \"total_users\": total_users,\n                    \"birthright_entitlements\": birthright_entitlements\n                }\n\n        return birthright_roles\n\n    def detect_role_explosion(self):\n        \"\"\"Identify roles with excessive overlap indicating need for consolidation.\"\"\"\n        roles = self.access_data.groupby(\"job_code\").apply(\n            lambda x: set(zip(x[\"application\"], x[\"entitlement\"]))\n        )\n\n        overlap_report = []\n        for (role1, ents1), (role2, ents2) in combinations(roles.items(), 2):\n            if len(ents1) == 0 or len(ents2) == 0:\n                continue\n            overlap = len(ents1 & ents2)\n            max_size = max(len(ents1), len(ents2))\n            overlap_pct = overlap \u002F max_size * 100\n\n            if overlap_pct > 70:\n                overlap_report.append({\n                    \"role_1\": role1,\n                    \"role_2\": role2,\n                    \"role_1_entitlements\": len(ents1),\n                    \"role_2_entitlements\": len(ents2),\n                    \"overlapping_entitlements\": overlap,\n                    \"overlap_percentage\": round(overlap_pct, 1),\n                    \"recommendation\": \"CONSOLIDATE\" if overlap_pct > 90 else \"REVIEW\"\n                })\n\n        return sorted(overlap_report, key=lambda x: x[\"overlap_percentage\"], reverse=True)\n\n    def find_orphaned_access(self):\n        \"\"\"\n        Find entitlements that no longer align with any role definition.\n        These are exceptions that accumulated over time.\n        \"\"\"\n        # Get birthright definitions\n        birthright = self.mine_birthright_roles(min_assignment_pct=0.5)\n\n        orphaned = []\n        for _, row in self.access_data.iterrows():\n            job_birthright = birthright.get(row[\"job_code\"], {})\n            expected_ents = set()\n            for ent in job_birthright.get(\"birthright_entitlements\", []):\n                expected_ents.add((ent[\"application\"], ent[\"entitlement\"]))\n\n            current_ent = (row[\"application\"], row[\"entitlement\"])\n            if current_ent not in expected_ents:\n                orphaned.append({\n                    \"employee_id\": row[\"employee_id\"],\n                    \"job_code\": row[\"job_code\"],\n                    \"application\": row[\"application\"],\n                    \"entitlement\": row[\"entitlement\"],\n                    \"recommendation\": \"Review for revocation\"\n                })\n\n        return pd.DataFrame(orphaned)\n```\n\n### Step 4: Build Access Request and Approval Workflow\n\nImplement self-service access request with risk-based approvals:\n\n```python\n\"\"\"\nAccess Request Workflow Engine\nHandles self-service access requests with multi-level approvals\nbased on risk classification of requested entitlements.\n\"\"\"\n\nACCESS_REQUEST_WORKFLOW = {\n    \"risk_levels\": {\n        \"LOW\": {\n            \"description\": \"Standard business applications\",\n            \"examples\": [\"Email distribution groups\", \"SharePoint team sites\", \"Standard SaaS apps\"],\n            \"approval_chain\": [\"manager\"],\n            \"sla_hours\": 4,\n            \"auto_approve_if_birthright\": True\n        },\n        \"MEDIUM\": {\n            \"description\": \"Sensitive data access or elevated permissions\",\n            \"examples\": [\"CRM admin\", \"Financial reporting\", \"HR systems\"],\n            \"approval_chain\": [\"manager\", \"application_owner\"],\n            \"sla_hours\": 24,\n            \"auto_approve_if_birthright\": False\n        },\n        \"HIGH\": {\n            \"description\": \"Privileged access or regulated data\",\n            \"examples\": [\"Database admin\", \"Cloud admin\", \"PAM vault access\"],\n            \"approval_chain\": [\"manager\", \"application_owner\", \"security_team\"],\n            \"sla_hours\": 48,\n            \"auto_approve_if_birthright\": False,\n            \"require_justification\": True,\n            \"require_time_limit\": True\n        },\n        \"CRITICAL\": {\n            \"description\": \"Domain admin, root access, or production data modification\",\n            \"examples\": [\"Domain Admin\", \"AWS root\", \"Production DB write\"],\n            \"approval_chain\": [\"manager\", \"application_owner\", \"security_team\", \"ciso\"],\n            \"sla_hours\": 72,\n            \"auto_approve_if_birthright\": False,\n            \"require_justification\": True,\n            \"require_time_limit\": True,\n            \"require_sod_check\": True,\n            \"max_duration_days\": 90\n        }\n    }\n}\n\nclass AccessRequestEngine:\n    def __init__(self, iga_client, risk_catalog):\n        self.iga = iga_client\n        self.risk_catalog = risk_catalog\n\n    def submit_request(self, requester_id, entitlement_id, justification, duration_days=None):\n        \"\"\"Submit an access request with automatic risk classification.\"\"\"\n        # Classify risk level of requested entitlement\n        risk_level = self.risk_catalog.get_risk_level(entitlement_id)\n        workflow = ACCESS_REQUEST_WORKFLOW[\"risk_levels\"][risk_level]\n\n        # Check if entitlement is birthright for requester's role\n        requester = self.iga.get_identity(requester_id)\n        is_birthright = self.iga.is_birthright_for_role(\n            entitlement_id, requester[\"job_code\"]\n        )\n\n        if is_birthright and workflow.get(\"auto_approve_if_birthright\"):\n            return self._auto_approve(requester_id, entitlement_id, \"Birthright access\")\n\n        # Run SOD check if required\n        if workflow.get(\"require_sod_check\"):\n            sod_violations = self.iga.check_sod(requester_id, entitlement_id)\n            if sod_violations:\n                return {\n                    \"status\": \"SOD_VIOLATION\",\n                    \"violations\": sod_violations,\n                    \"action\": \"Request requires compensating control approval\"\n                }\n\n        # Create approval chain\n        request = {\n            \"requester\": requester_id,\n            \"entitlement\": entitlement_id,\n            \"risk_level\": risk_level,\n            \"justification\": justification,\n            \"duration_days\": duration_days or workflow.get(\"max_duration_days\"),\n            \"approval_chain\": self._build_approval_chain(\n                requester, workflow[\"approval_chain\"]\n            ),\n            \"sla_deadline\": workflow[\"sla_hours\"],\n            \"status\": \"PENDING_APPROVAL\"\n        }\n\n        return self.iga.create_request(request)\n\n    def _build_approval_chain(self, requester, approver_types):\n        \"\"\"Resolve approval chain to actual approver identities.\"\"\"\n        chain = []\n        for approver_type in approver_types:\n            if approver_type == \"manager\":\n                chain.append({\n                    \"type\": \"manager\",\n                    \"identity\": requester[\"manager_id\"],\n                    \"fallback\": requester.get(\"skip_manager_id\")\n                })\n            elif approver_type == \"application_owner\":\n                chain.append({\n                    \"type\": \"application_owner\",\n                    \"identity\": \"resolved_at_runtime\",\n                    \"fallback\": \"it-governance-team\"\n                })\n            elif approver_type == \"security_team\":\n                chain.append({\n                    \"type\": \"group\",\n                    \"identity\": \"security-governance-team\",\n                    \"required_approvals\": 1\n                })\n            elif approver_type == \"ciso\":\n                chain.append({\n                    \"type\": \"role\",\n                    \"identity\": \"CISO\",\n                    \"fallback\": \"deputy-ciso\"\n                })\n        return chain\n```\n\n### Step 5: Implement Orphaned Account Detection and Remediation\n\nIdentify and remediate accounts without active identity associations:\n\n```python\n\"\"\"\nOrphaned Account Detection\nIdentifies accounts in target systems that have no corresponding\nactive identity in the authoritative HR source.\n\"\"\"\n\nclass OrphanedAccountDetector:\n    def __init__(self, hr_connector, app_connectors):\n        self.hr = hr_connector\n        self.apps = app_connectors\n\n    def detect_orphaned_accounts(self):\n        \"\"\"Compare application accounts against HR active employees.\"\"\"\n        active_employees = set(self.hr.get_active_employee_ids())\n        orphaned_accounts = []\n\n        for app_name, connector in self.apps.items():\n            app_accounts = connector.get_all_accounts()\n\n            for account in app_accounts:\n                correlated_id = account.get(\"employee_id\") or account.get(\"correlation_id\")\n\n                if correlated_id and correlated_id not in active_employees:\n                    # Check if recently terminated (within grace period)\n                    termination_info = self.hr.get_termination_info(correlated_id)\n\n                    orphaned_accounts.append({\n                        \"application\": app_name,\n                        \"account_name\": account[\"username\"],\n                        \"correlated_employee_id\": correlated_id,\n                        \"account_status\": account.get(\"status\", \"unknown\"),\n                        \"last_login\": account.get(\"last_login\"),\n                        \"termination_date\": termination_info.get(\"date\") if termination_info else None,\n                        \"days_since_termination\": (\n                            (datetime.utcnow() - termination_info[\"date\"]).days\n                            if termination_info and termination_info.get(\"date\") else None\n                        ),\n                        \"risk_level\": self._assess_orphan_risk(account, termination_info)\n                    })\n\n                elif not correlated_id:\n                    # Uncorrelated account - no link to any employee\n                    orphaned_accounts.append({\n                        \"application\": app_name,\n                        \"account_name\": account[\"username\"],\n                        \"correlated_employee_id\": None,\n                        \"account_status\": account.get(\"status\", \"unknown\"),\n                        \"last_login\": account.get(\"last_login\"),\n                        \"risk_level\": \"HIGH\",\n                        \"reason\": \"Uncorrelated - no employee association\"\n                    })\n\n        return orphaned_accounts\n\n    def _assess_orphan_risk(self, account, termination_info):\n        \"\"\"Assess risk level of orphaned account.\"\"\"\n        if account.get(\"is_privileged\"):\n            return \"CRITICAL\"\n        if termination_info and termination_info.get(\"involuntary\"):\n            return \"HIGH\"\n        if account.get(\"status\") == \"active\":\n            return \"HIGH\"\n        return \"MEDIUM\"\n\n    def generate_remediation_plan(self, orphaned_accounts):\n        \"\"\"Create remediation actions for orphaned accounts.\"\"\"\n        plan = []\n        for account in orphaned_accounts:\n            if account[\"risk_level\"] == \"CRITICAL\":\n                action = \"DISABLE_IMMEDIATELY\"\n                sla = \"4 hours\"\n            elif account[\"risk_level\"] == \"HIGH\":\n                action = \"DISABLE_WITHIN_24H\"\n                sla = \"24 hours\"\n            else:\n                action = \"REVIEW_AND_DISABLE\"\n                sla = \"7 days\"\n\n            plan.append({\n                **account,\n                \"remediation_action\": action,\n                \"sla\": sla,\n                \"assigned_to\": \"identity-governance-team\"\n            })\n\n        return sorted(plan, key=lambda x: [\"CRITICAL\", \"HIGH\", \"MEDIUM\", \"LOW\"].index(x[\"risk_level\"]))\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Joiner-Mover-Leaver (JML)** | Core identity lifecycle transitions covering employee onboarding (joiner), role\u002Fdepartment changes (mover), and offboarding (leaver) |\n| **Birthright Access** | Baseline entitlements automatically provisioned based on job code, department, or location without requiring an access request |\n| **Role Mining** | Analysis of existing access patterns to derive role definitions by identifying common entitlement groupings across similar job functions |\n| **Orphaned Account** | Application account that no longer has a corresponding active identity in the authoritative HR source, representing a security risk |\n| **Authoritative Source** | System of record (typically HR) that serves as the single source of truth for identity attributes and employment status |\n| **Access Request Workflow** | Self-service process enabling users to request additional entitlements with risk-based approval routing |\n\n## Tools & Systems\n\n- **SailPoint IdentityIQ\u002FIdentityNow**: Enterprise IGA platform for lifecycle management, access certifications, and automated provisioning\n- **Saviynt Enterprise Identity Cloud**: Cloud-native IGA with identity warehouse, access governance, and application access management\n- **Microsoft Entra ID Governance**: Identity governance capabilities including lifecycle workflows, access reviews, and entitlement management\n- **One Identity Manager**: IGA solution with business role management, attestation, and IT shop for access requests\n\n## Common Scenarios\n\n### Scenario: Building JML Process for 10,000-Employee Organization\n\n**Context**: Rapidly growing company has no automated identity lifecycle. IT manually creates accounts, taking 3-5 days for new hires. Terminated employees retain access for weeks. Audit found 2,300 orphaned accounts across 45 applications.\n\n**Approach**:\n1. Integrate Workday as authoritative source with daily delta sync to IGA platform\n2. Mine existing access patterns to define birthright roles for the top 20 job codes (covering 80% of employees)\n3. Implement pre-hire provisioning triggered 7 days before start date for AD, email, and birthright apps\n4. Build termination workflow that disables all access within 1 hour of HR status change\n5. Create mover workflow that recalculates roles when job code or department changes\n6. Deploy self-service access request portal with risk-based approval chains\n7. Run orphaned account detection to identify and remediate the 2,300 existing orphans\n8. Schedule quarterly access certifications to prevent access accumulation\n\n**Pitfalls**:\n- Not defining a single authoritative source leads to conflicting identity data from multiple HR systems\n- Mining roles without business validation creates technical roles that do not align with organizational structure\n- Automating termination without grace period for knowledge transfer frustrates business managers\n- Not handling contractor and vendor identities that exist outside the HR system\n\n## Output Format\n\n```\nIDENTITY GOVERNANCE LIFECYCLE REPORT\n=======================================\nAuthoritative Source:   Workday\nIGA Platform:          SailPoint IdentityIQ\nTotal Identities:      10,247\nActive Employees:      9,834\nContractors:           413\n\nLIFECYCLE AUTOMATION\nJoiner (Pre-Hire) SLA:     Target: 0 days | Actual: 0.2 days avg\nMover Processing SLA:      Target: 1 day  | Actual: 0.8 days avg\nLeaver Disablement SLA:    Target: 1 hour | Actual: 0.5 hours avg\n\nPROVISIONING METRICS (Last 30 Days)\nNew Hires Provisioned:     187\n  Auto-Provisioned:        174 (93.0%)\n  Manual Intervention:     13 (7.0%)\nRole Changes Processed:    89\nTerminations Processed:    43\n  Within 1-Hour SLA:       41 (95.3%)\n\nROLE GOVERNANCE\nDefined Roles:             127\nBirthright Roles:          48\nAverage Entitlements\u002FRole: 12.3\nRole Overlap > 70%:        8 pairs (consolidation recommended)\n\nORPHANED ACCOUNTS\nDetected:                  23\n  Critical:                2 (privileged accounts)\n  High:                    8\n  Medium:                  13\nRemediated (30 days):      19\nOutstanding:               4\n\nACCESS REQUESTS\nSubmitted:                 342\nAuto-Approved (Birthright):87 (25.4%)\nApproved:                  231 (67.5%)\nDenied:                    24 (7.0%)\nAverage Approval Time:     6.2 hours\nSOD Violations Flagged:    12\n```\n","# Building Identity Governance Lifecycle Process\n\n## When to Use\n\n- Organization lacks automated joiner-mover-leaver (JML) processes for identity management\n- Access provisioning is manual and takes days, creating productivity loss and security gaps\n- Former employees retain access to systems after termination (orphaned accounts)\n- Role explosion has created thousands of roles with unclear ownership and overlapping entitlements\n- Compliance requirements mandate documented identity lifecycle processes (SOX, HIPAA, GDPR)\n- No centralized visibility into who has access to what across the enterprise\n\n**Do not use** for single-application user management; identity governance addresses cross-system lifecycle management requiring correlation of authoritative HR sources with downstream application provisioning.\n\n## Prerequisites\n\n- Authoritative HR system (Workday, SAP SuccessFactors, BambooHR) as identity source of truth\n- IGA platform (SailPoint, Saviynt, One Identity) or Microsoft Entra ID Governance\n- Active Directory and\u002For Azure AD as primary directory services\n- Application connectors for target systems requiring automated provisioning\n- Defined organizational role structure and reporting hierarchy\n- Stakeholder buy-in from HR, IT, security, and business unit managers\n\n## Workflow\n\n### Step 1: Define Identity Lifecycle States and Transitions\n\nMap the identity lifecycle from hire to termination:\n\n```python\n\"\"\"\nIdentity Lifecycle State Machine\nDefines all identity states and valid transitions with automated actions.\n\"\"\"\n\nIDENTITY_LIFECYCLE = {\n    \"states\": {\n        \"PRE_HIRE\": {\n            \"description\": \"Identity created from HR feed before start date\",\n            \"automated_actions\": [\n                \"Create identity record in IGA platform\",\n                \"Generate unique employee ID\",\n                \"Create mailbox reservation\",\n                \"Assign birthright roles based on job code\",\n                \"Initiate background check workflow\"\n            ],\n            \"valid_transitions\": [\"ACTIVE\", \"CANCELLED\"]\n        },\n        \"ACTIVE\": {\n            \"description\": \"Employee has started, full access provisioned\",\n            \"automated_actions\": [\n                \"Create Active Directory account\",\n                \"Create email mailbox\",\n                \"Provision birthright application access\",\n                \"Assign department-specific roles\",\n                \"Add to distribution groups\",\n                \"Issue MFA token\u002Fsecurity key\",\n                \"Create VPN account if remote worker\"\n            ],\n            \"valid_transitions\": [\"ROLE_CHANGE\", \"LEAVE_OF_ABSENCE\", \"TERMINATED\"]\n        },\n        \"ROLE_CHANGE\": {\n            \"description\": \"Employee transferred, promoted, or changed departments\",\n            \"automated_actions\": [\n                \"Recalculate role assignments based on new job code\",\n                \"Remove access from previous department applications\",\n                \"Provision access for new department applications\",\n                \"Update group memberships\",\n                \"Transfer manager in directory\",\n                \"Trigger access review for retained entitlements\",\n                \"Notify new manager of inherited access\"\n            ],\n            \"valid_transitions\": [\"ACTIVE\", \"LEAVE_OF_ABSENCE\", \"TERMINATED\"]\n        },\n        \"LEAVE_OF_ABSENCE\": {\n            \"description\": \"Employee on extended leave (medical, parental, sabbatical)\",\n            \"automated_actions\": [\n                \"Disable interactive login (preserve account)\",\n                \"Suspend VPN access\",\n                \"Set out-of-office auto-reply\",\n                \"Delegate mailbox to manager\",\n                \"Preserve all role assignments for return\",\n                \"Set reactivation date from HR feed\"\n            ],\n            \"valid_transitions\": [\"ACTIVE\", \"TERMINATED\"]\n        },\n        \"TERMINATED\": {\n            \"description\": \"Employee has left the organization\",\n            \"automated_actions\": [\n                \"Disable AD account immediately\",\n                \"Revoke all application access\",\n                \"Revoke VPN and remote access\",\n                \"Convert mailbox to shared (manager access for 90 days)\",\n                \"Transfer OneDrive files to manager\",\n                \"Remove from all security and distribution groups\",\n                \"Revoke OAuth tokens and API keys\",\n                \"Wipe corporate data from mobile devices\",\n                \"Archive identity record\",\n                \"Schedule account deletion after retention period\"\n            ],\n            \"valid_transitions\": [\"REHIRE\", \"DELETED\"]\n        },\n        \"REHIRE\": {\n            \"description\": \"Previously terminated employee returning\",\n            \"automated_actions\": [\n                \"Reactivate existing identity record\",\n                \"Reset credentials and require MFA re-enrollment\",\n                \"Provision based on new job code (not previous access)\",\n                \"Flag for enhanced access review in first 30 days\"\n            ],\n            \"valid_transitions\": [\"ACTIVE\"]\n        },\n        \"DELETED\": {\n            \"description\": \"Account permanently removed after retention period\",\n            \"automated_actions\": [\n                \"Delete AD account\",\n                \"Delete email mailbox archive\",\n                \"Remove identity record from IGA\",\n                \"Generate deletion audit log\"\n            ],\n            \"valid_transitions\": []\n        }\n    },\n    \"retention_periods\": {\n        \"terminated_to_deleted\": \"90 days (default)\",\n        \"mailbox_retention\": \"90 days as shared mailbox\",\n        \"onedrive_retention\": \"30 days manager access, then archived\",\n        \"audit_log_retention\": \"7 years for compliance\"\n    }\n}\n```\n\n### Step 2: Implement Authoritative Source Integration\n\nConnect HR system as the single source of truth for identity data:\n\n```python\n\"\"\"\nHR Source Integration - Workday to IGA Platform Connector\nPolls Workday for employee lifecycle events and triggers provisioning.\n\"\"\"\nimport requests\nfrom datetime import datetime, timedelta\nimport logging\n\nclass WorkdayIdentityConnector:\n    def __init__(self, config):\n        self.base_url = config[\"workday_api_url\"]\n        self.tenant = config[\"tenant\"]\n        self.client_id = config[\"client_id\"]\n        self.client_secret = config[\"client_secret\"]\n        self.session = requests.Session()\n        self.logger = logging.getLogger(\"workday_connector\")\n\n    def get_access_token(self):\n        \"\"\"Authenticate to Workday REST API.\"\"\"\n        token_url = f\"{self.base_url}\u002Fccx\u002Foauth2\u002F{self.tenant}\u002Ftoken\"\n        response = self.session.post(token_url, data={\n            \"grant_type\": \"client_credentials\",\n            \"client_id\": self.client_id,\n            \"client_secret\": self.client_secret\n        })\n        response.raise_for_status()\n        return response.json()[\"access_token\"]\n\n    def fetch_worker_changes(self, since_datetime):\n        \"\"\"Fetch all worker lifecycle events since the last sync.\"\"\"\n        headers = {\"Authorization\": f\"Bearer {self.get_access_token()}\"}\n        params = {\n            \"Updated_From\": since_datetime.isoformat(),\n            \"Updated_Through\": datetime.utcnow().isoformat(),\n            \"Count\": 100\n        }\n\n        workers = []\n        url = f\"{self.base_url}\u002Fccx\u002Fapi\u002Fv1\u002F{self.tenant}\u002Fworkers\"\n\n        while url:\n            response = self.session.get(url, headers=headers, params=params)\n            response.raise_for_status()\n            data = response.json()\n            workers.extend(data.get(\"data\", []))\n            url = data.get(\"next\", None)\n            params = {}\n\n        return workers\n\n    def map_lifecycle_event(self, worker):\n        \"\"\"Map Workday worker data to identity lifecycle event.\"\"\"\n        worker_data = worker.get(\"workerData\", {})\n        employment = worker_data.get(\"employmentData\", {})\n        personal = worker_data.get(\"personalData\", {})\n\n        event = {\n            \"employee_id\": worker.get(\"id\"),\n            \"first_name\": personal.get(\"legalName\", {}).get(\"firstName\"),\n            \"last_name\": personal.get(\"legalName\", {}).get(\"lastName\"),\n            \"email\": worker_data.get(\"emailAddress\"),\n            \"job_code\": employment.get(\"jobProfile\", {}).get(\"id\"),\n            \"job_title\": employment.get(\"jobProfile\", {}).get(\"name\"),\n            \"department\": employment.get(\"organization\", {}).get(\"name\"),\n            \"department_code\": employment.get(\"organization\", {}).get(\"id\"),\n            \"manager_id\": employment.get(\"managerId\"),\n            \"location\": employment.get(\"location\", {}).get(\"name\"),\n            \"cost_center\": employment.get(\"costCenter\", {}).get(\"id\"),\n            \"hire_date\": employment.get(\"hireDate\"),\n            \"termination_date\": employment.get(\"terminationDate\"),\n            \"status\": employment.get(\"status\"),\n            \"worker_type\": employment.get(\"workerType\"),\n        }\n\n        # Determine lifecycle transition\n        if event[\"status\"] == \"Active\" and event[\"hire_date\"]:\n            hire_date = datetime.fromisoformat(event[\"hire_date\"])\n            if hire_date > datetime.utcnow():\n                event[\"lifecycle_event\"] = \"PRE_HIRE\"\n            else:\n                event[\"lifecycle_event\"] = \"JOINER\"\n        elif event[\"status\"] == \"Active\":\n            event[\"lifecycle_event\"] = \"MOVER\"  # Department or role change\n        elif event[\"status\"] == \"Terminated\":\n            event[\"lifecycle_event\"] = \"LEAVER\"\n        elif event[\"status\"] == \"On Leave\":\n            event[\"lifecycle_event\"] = \"LEAVE_OF_ABSENCE\"\n\n        return event\n\n    def process_lifecycle_events(self, since_datetime):\n        \"\"\"Main processing loop for identity lifecycle events.\"\"\"\n        workers = self.fetch_worker_changes(since_datetime)\n        events = []\n\n        for worker in workers:\n            event = self.map_lifecycle_event(worker)\n            events.append(event)\n            self.logger.info(\n                f\"Lifecycle event: {event['lifecycle_event']} for \"\n                f\"{event['first_name']} {event['last_name']} \"\n                f\"(EmpID: {event['employee_id']})\"\n            )\n\n        return events\n```\n\n### Step 3: Implement Role Mining and Birthright Access\n\nDefine roles based on job functions for automated provisioning:\n\n```python\n\"\"\"\nRole Mining Engine\nAnalyzes existing access patterns to derive role definitions\nfor birthright (automatic) provisioning.\n\"\"\"\nimport pandas as pd\nfrom collections import Counter\nfrom itertools import combinations\n\nclass RoleMiningEngine:\n    def __init__(self, access_data):\n        \"\"\"\n        access_data: DataFrame with columns\n        [employee_id, job_code, department, application, entitlement]\n        \"\"\"\n        self.access_data = access_data\n\n    def mine_birthright_roles(self, min_assignment_pct=0.8):\n        \"\"\"\n        Identify entitlements that should be automatically assigned\n        based on job code. If 80%+ of users with same job code\n        have an entitlement, it becomes birthright access.\n        \"\"\"\n        birthright_roles = {}\n\n        for job_code, group in self.access_data.groupby(\"job_code\"):\n            total_users = group[\"employee_id\"].nunique()\n            entitlement_counts = group.groupby(\n                [\"application\", \"entitlement\"]\n            )[\"employee_id\"].nunique()\n\n            birthright_entitlements = []\n            for (app, ent), count in entitlement_counts.items():\n                pct = count \u002F total_users\n                if pct >= min_assignment_pct:\n                    birthright_entitlements.append({\n                        \"application\": app,\n                        \"entitlement\": ent,\n                        \"assignment_percentage\": round(pct * 100, 1),\n                        \"user_count\": count\n                    })\n\n            if birthright_entitlements:\n                birthright_roles[job_code] = {\n                    \"job_code\": job_code,\n                    \"total_users\": total_users,\n                    \"birthright_entitlements\": birthright_entitlements\n                }\n\n        return birthright_roles\n\n    def detect_role_explosion(self):\n        \"\"\"Identify roles with excessive overlap indicating need for consolidation.\"\"\"\n        roles = self.access_data.groupby(\"job_code\").apply(\n            lambda x: set(zip(x[\"application\"], x[\"entitlement\"]))\n        )\n\n        overlap_report = []\n        for (role1, ents1), (role2, ents2) in combinations(roles.items(), 2):\n            if len(ents1) == 0 or len(ents2) == 0:\n                continue\n            overlap = len(ents1 & ents2)\n            max_size = max(len(ents1), len(ents2))\n            overlap_pct = overlap \u002F max_size * 100\n\n            if overlap_pct > 70:\n                overlap_report.append({\n                    \"role_1\": role1,\n                    \"role_2\": role2,\n                    \"role_1_entitlements\": len(ents1),\n                    \"role_2_entitlements\": len(ents2),\n                    \"overlapping_entitlements\": overlap,\n                    \"overlap_percentage\": round(overlap_pct, 1),\n                    \"recommendation\": \"CONSOLIDATE\" if overlap_pct > 90 else \"REVIEW\"\n                })\n\n        return sorted(overlap_report, key=lambda x: x[\"overlap_percentage\"], reverse=True)\n\n    def find_orphaned_access(self):\n        \"\"\"\n        Find entitlements that no longer align with any role definition.\n        These are exceptions that accumulated over time.\n        \"\"\"\n        # Get birthright definitions\n        birthright = self.mine_birthright_roles(min_assignment_pct=0.5)\n\n        orphaned = []\n        for _, row in self.access_data.iterrows():\n            job_birthright = birthright.get(row[\"job_code\"], {})\n            expected_ents = set()\n            for ent in job_birthright.get(\"birthright_entitlements\", []):\n                expected_ents.add((ent[\"application\"], ent[\"entitlement\"]))\n\n            current_ent = (row[\"application\"], row[\"entitlement\"])\n            if current_ent not in expected_ents:\n                orphaned.append({\n                    \"employee_id\": row[\"employee_id\"],\n                    \"job_code\": row[\"job_code\"],\n                    \"application\": row[\"application\"],\n                    \"entitlement\": row[\"entitlement\"],\n                    \"recommendation\": \"Review for revocation\"\n                })\n\n        return pd.DataFrame(orphaned)\n```\n\n### Step 4: Build Access Request and Approval Workflow\n\nImplement self-service access request with risk-based approvals:\n\n```python\n\"\"\"\nAccess Request Workflow Engine\nHandles self-service access requests with multi-level approvals\nbased on risk classification of requested entitlements.\n\"\"\"\n\nACCESS_REQUEST_WORKFLOW = {\n    \"risk_levels\": {\n        \"LOW\": {\n            \"description\": \"Standard business applications\",\n            \"examples\": [\"Email distribution groups\", \"SharePoint team sites\", \"Standard SaaS apps\"],\n            \"approval_chain\": [\"manager\"],\n            \"sla_hours\": 4,\n            \"auto_approve_if_birthright\": True\n        },\n        \"MEDIUM\": {\n            \"description\": \"Sensitive data access or elevated permissions\",\n            \"examples\": [\"CRM admin\", \"Financial reporting\", \"HR systems\"],\n            \"approval_chain\": [\"manager\", \"application_owner\"],\n            \"sla_hours\": 24,\n            \"auto_approve_if_birthright\": False\n        },\n        \"HIGH\": {\n            \"description\": \"Privileged access or regulated data\",\n            \"examples\": [\"Database admin\", \"Cloud admin\", \"PAM vault access\"],\n            \"approval_chain\": [\"manager\", \"application_owner\", \"security_team\"],\n            \"sla_hours\": 48,\n            \"auto_approve_if_birthright\": False,\n            \"require_justification\": True,\n            \"require_time_limit\": True\n        },\n        \"CRITICAL\": {\n            \"description\": \"Domain admin, root access, or production data modification\",\n            \"examples\": [\"Domain Admin\", \"AWS root\", \"Production DB write\"],\n            \"approval_chain\": [\"manager\", \"application_owner\", \"security_team\", \"ciso\"],\n            \"sla_hours\": 72,\n            \"auto_approve_if_birthright\": False,\n            \"require_justification\": True,\n            \"require_time_limit\": True,\n            \"require_sod_check\": True,\n            \"max_duration_days\": 90\n        }\n    }\n}\n\nclass AccessRequestEngine:\n    def __init__(self, iga_client, risk_catalog):\n        self.iga = iga_client\n        self.risk_catalog = risk_catalog\n\n    def submit_request(self, requester_id, entitlement_id, justification, duration_days=None):\n        \"\"\"Submit an access request with automatic risk classification.\"\"\"\n        # Classify risk level of requested entitlement\n        risk_level = self.risk_catalog.get_risk_level(entitlement_id)\n        workflow = ACCESS_REQUEST_WORKFLOW[\"risk_levels\"][risk_level]\n\n        # Check if entitlement is birthright for requester's role\n        requester = self.iga.get_identity(requester_id)\n        is_birthright = self.iga.is_birthright_for_role(\n            entitlement_id, requester[\"job_code\"]\n        )\n\n        if is_birthright and workflow.get(\"auto_approve_if_birthright\"):\n            return self._auto_approve(requester_id, entitlement_id, \"Birthright access\")\n\n        # Run SOD check if required\n        if workflow.get(\"require_sod_check\"):\n            sod_violations = self.iga.check_sod(requester_id, entitlement_id)\n            if sod_violations:\n                return {\n                    \"status\": \"SOD_VIOLATION\",\n                    \"violations\": sod_violations,\n                    \"action\": \"Request requires compensating control approval\"\n                }\n\n        # Create approval chain\n        request = {\n            \"requester\": requester_id,\n            \"entitlement\": entitlement_id,\n            \"risk_level\": risk_level,\n            \"justification\": justification,\n            \"duration_days\": duration_days or workflow.get(\"max_duration_days\"),\n            \"approval_chain\": self._build_approval_chain(\n                requester, workflow[\"approval_chain\"]\n            ),\n            \"sla_deadline\": workflow[\"sla_hours\"],\n            \"status\": \"PENDING_APPROVAL\"\n        }\n\n        return self.iga.create_request(request)\n\n    def _build_approval_chain(self, requester, approver_types):\n        \"\"\"Resolve approval chain to actual approver identities.\"\"\"\n        chain = []\n        for approver_type in approver_types:\n            if approver_type == \"manager\":\n                chain.append({\n                    \"type\": \"manager\",\n                    \"identity\": requester[\"manager_id\"],\n                    \"fallback\": requester.get(\"skip_manager_id\")\n                })\n            elif approver_type == \"application_owner\":\n                chain.append({\n                    \"type\": \"application_owner\",\n                    \"identity\": \"resolved_at_runtime\",\n                    \"fallback\": \"it-governance-team\"\n                })\n            elif approver_type == \"security_team\":\n                chain.append({\n                    \"type\": \"group\",\n                    \"identity\": \"security-governance-team\",\n                    \"required_approvals\": 1\n                })\n            elif approver_type == \"ciso\":\n                chain.append({\n                    \"type\": \"role\",\n                    \"identity\": \"CISO\",\n                    \"fallback\": \"deputy-ciso\"\n                })\n        return chain\n```\n\n### Step 5: Implement Orphaned Account Detection and Remediation\n\nIdentify and remediate accounts without active identity associations:\n\n```python\n\"\"\"\nOrphaned Account Detection\nIdentifies accounts in target systems that have no corresponding\nactive identity in the authoritative HR source.\n\"\"\"\n\nclass OrphanedAccountDetector:\n    def __init__(self, hr_connector, app_connectors):\n        self.hr = hr_connector\n        self.apps = app_connectors\n\n    def detect_orphaned_accounts(self):\n        \"\"\"Compare application accounts against HR active employees.\"\"\"\n        active_employees = set(self.hr.get_active_employee_ids())\n        orphaned_accounts = []\n\n        for app_name, connector in self.apps.items():\n            app_accounts = connector.get_all_accounts()\n\n            for account in app_accounts:\n                correlated_id = account.get(\"employee_id\") or account.get(\"correlation_id\")\n\n                if correlated_id and correlated_id not in active_employees:\n                    # Check if recently terminated (within grace period)\n                    termination_info = self.hr.get_termination_info(correlated_id)\n\n                    orphaned_accounts.append({\n                        \"application\": app_name,\n                        \"account_name\": account[\"username\"],\n                        \"correlated_employee_id\": correlated_id,\n                        \"account_status\": account.get(\"status\", \"unknown\"),\n                        \"last_login\": account.get(\"last_login\"),\n                        \"termination_date\": termination_info.get(\"date\") if termination_info else None,\n                        \"days_since_termination\": (\n                            (datetime.utcnow() - termination_info[\"date\"]).days\n                            if termination_info and termination_info.get(\"date\") else None\n                        ),\n                        \"risk_level\": self._assess_orphan_risk(account, termination_info)\n                    })\n\n                elif not correlated_id:\n                    # Uncorrelated account - no link to any employee\n                    orphaned_accounts.append({\n                        \"application\": app_name,\n                        \"account_name\": account[\"username\"],\n                        \"correlated_employee_id\": None,\n                        \"account_status\": account.get(\"status\", \"unknown\"),\n                        \"last_login\": account.get(\"last_login\"),\n                        \"risk_level\": \"HIGH\",\n                        \"reason\": \"Uncorrelated - no employee association\"\n                    })\n\n        return orphaned_accounts\n\n    def _assess_orphan_risk(self, account, termination_info):\n        \"\"\"Assess risk level of orphaned account.\"\"\"\n        if account.get(\"is_privileged\"):\n            return \"CRITICAL\"\n        if termination_info and termination_info.get(\"involuntary\"):\n            return \"HIGH\"\n        if account.get(\"status\") == \"active\":\n            return \"HIGH\"\n        return \"MEDIUM\"\n\n    def generate_remediation_plan(self, orphaned_accounts):\n        \"\"\"Create remediation actions for orphaned accounts.\"\"\"\n        plan = []\n        for account in orphaned_accounts:\n            if account[\"risk_level\"] == \"CRITICAL\":\n                action = \"DISABLE_IMMEDIATELY\"\n                sla = \"4 hours\"\n            elif account[\"risk_level\"] == \"HIGH\":\n                action = \"DISABLE_WITHIN_24H\"\n                sla = \"24 hours\"\n            else:\n                action = \"REVIEW_AND_DISABLE\"\n                sla = \"7 days\"\n\n            plan.append({\n                **account,\n                \"remediation_action\": action,\n                \"sla\": sla,\n                \"assigned_to\": \"identity-governance-team\"\n            })\n\n        return sorted(plan, key=lambda x: [\"CRITICAL\", \"HIGH\", \"MEDIUM\", \"LOW\"].index(x[\"risk_level\"]))\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Joiner-Mover-Leaver (JML)** | Core identity lifecycle transitions covering employee onboarding (joiner), role\u002Fdepartment changes (mover), and offboarding (leaver) |\n| **Birthright Access** | Baseline entitlements automatically provisioned based on job code, department, or location without requiring an access request |\n| **Role Mining** | Analysis of existing access patterns to derive role definitions by identifying common entitlement groupings across similar job functions |\n| **Orphaned Account** | Application account that no longer has a corresponding active identity in the authoritative HR source, representing a security risk |\n| **Authoritative Source** | System of record (typically HR) that serves as the single source of truth for identity attributes and employment status |\n| **Access Request Workflow** | Self-service process enabling users to request additional entitlements with risk-based approval routing |\n\n## Tools & Systems\n\n- **SailPoint IdentityIQ\u002FIdentityNow**: Enterprise IGA platform for lifecycle management, access certifications, and automated provisioning\n- **Saviynt Enterprise Identity Cloud**: Cloud-native IGA with identity warehouse, access governance, and application access management\n- **Microsoft Entra ID Governance**: Identity governance capabilities including lifecycle workflows, access reviews, and entitlement management\n- **One Identity Manager**: IGA solution with business role management, attestation, and IT shop for access requests\n\n## Common Scenarios\n\n### Scenario: Building JML Process for 10,000-Employee Organization\n\n**Context**: Rapidly growing company has no automated identity lifecycle. IT manually creates accounts, taking 3-5 days for new hires. Terminated employees retain access for weeks. Audit found 2,300 orphaned accounts across 45 applications.\n\n**Approach**:\n1. Integrate Workday as authoritative source with daily delta sync to IGA platform\n2. Mine existing access patterns to define birthright roles for the top 20 job codes (covering 80% of employees)\n3. Implement pre-hire provisioning triggered 7 days before start date for AD, email, and birthright apps\n4. Build termination workflow that disables all access within 1 hour of HR status change\n5. Create mover workflow that recalculates roles when job code or department changes\n6. Deploy self-service access request portal with risk-based approval chains\n7. Run orphaned account detection to identify and remediate the 2,300 existing orphans\n8. Schedule quarterly access certifications to prevent access accumulation\n\n**Pitfalls**:\n- Not defining a single authoritative source leads to conflicting identity data from multiple HR systems\n- Mining roles without business validation creates technical roles that do not align with organizational structure\n- Automating termination without grace period for knowledge transfer frustrates business managers\n- Not handling contractor and vendor identities that exist outside the HR system\n\n## Output Format\n\n```\nIDENTITY GOVERNANCE LIFECYCLE REPORT\n=======================================\nAuthoritative Source:   Workday\nIGA Platform:          SailPoint IdentityIQ\nTotal Identities:      10,247\nActive Employees:      9,834\nContractors:           413\n\nLIFECYCLE AUTOMATION\nJoiner (Pre-Hire) SLA:     Target: 0 days | Actual: 0.2 days avg\nMover Processing SLA:      Target: 1 day  | Actual: 0.8 days avg\nLeaver Disablement SLA:    Target: 1 hour | Actual: 0.5 hours avg\n\nPROVISIONING METRICS (Last 30 Days)\nNew Hires Provisioned:     187\n  Auto-Provisioned:        174 (93.0%)\n  Manual Intervention:     13 (7.0%)\nRole Changes Processed:    89\nTerminations Processed:    43\n  Within 1-Hour SLA:       41 (95.3%)\n\nROLE GOVERNANCE\nDefined Roles:             127\nBirthright Roles:          48\nAverage Entitlements\u002FRole: 12.3\nRole Overlap > 70%:        8 pairs (consolidation recommended)\n\nORPHANED ACCOUNTS\nDetected:                  23\n  Critical:                2 (privileged accounts)\n  High:                    8\n  Medium:                  13\nRemediated (30 days):      19\nOutstanding:               4\n\nACCESS REQUESTS\nSubmitted:                 342\nAuto-Approved (Birthright):87 (25.4%)\nApproved:                  231 (67.5%)\nDenied:                    24 (7.0%)\nAverage Approval Time:     6.2 hours\nSOD Violations Flagged:    12\n```\n",{"name":5,"tags":46,"author":48,"domain":40,"license":15,"version":49,"mitre_f3":50,"nist_csf":73,"subdomain":78,"description":7,"nist_ai_rmf":79,"mitre_attack":83},[32,31,30,29,47,28],"RBAC","mahipal","1.0",{"tactics":51,"version":55,"techniques":56},[52,53,54],"positioning","defense-impairment","initial-access","1.1",[57,61,64,67,70],{"id":58,"name":59,"source":60,"tactic":52},"F1005","Account Manipulation","f3",{"id":62,"name":63,"source":60,"tactic":52},"F1005.002","Account Manipulation: Add Authorized User",{"id":65,"name":66,"source":60,"tactic":54},"F1033","Insider Access Abuse",{"id":68,"name":69,"source":60,"tactic":52},"F1042","Reactivate Account",{"id":71,"name":72,"source":60,"tactic":54},"F1006","Account Takeover",[74,75,76,77],"PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06","identity-access-management",[80,81,82],"GOVERN-1.1","GOVERN-1.7","MAP-1.1",[84,85,86,87,88],"T1098","T1136","T1078","T1531","T1087","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fbuilding-identity-governance-lifecycle-process",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":100,"prompt":110,"zipAvailable":111},[101,104,107],{"tool":102,"command":103},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill building-identity-governance-lifecycle-process",{"tool":105,"command":106},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill building-identity-governance-lifecycle-process",{"tool":108,"command":109},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill building-identity-governance-lifecycle-process","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-identity-governance-lifecycle-process\u002FSKILL.md",true,[113,119,123,127,131,136,140,144],{"path":114,"resourceType":115,"resourceTypeDesc":116,"sizeBytes":117,"sourceHtmlUrl":118},"examples\u002F3p-updates.md","REFERENCE","参考文档",3274,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fenterprise-communication\u002Finternal-comms-anthropic\u002Fexamples\u002F3p-updates.md",{"path":120,"resourceType":115,"resourceTypeDesc":116,"sizeBytes":121,"sourceHtmlUrl":122},"examples\u002Fcompany-newsletter.md",3295,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fenterprise-communication\u002Finternal-comms-anthropic\u002Fexamples\u002Fcompany-newsletter.md",{"path":124,"resourceType":115,"resourceTypeDesc":116,"sizeBytes":125,"sourceHtmlUrl":126},"examples\u002Ffaq-answers.md",2366,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fenterprise-communication\u002Finternal-comms-anthropic\u002Fexamples\u002Ffaq-answers.md",{"path":128,"resourceType":115,"resourceTypeDesc":116,"sizeBytes":129,"sourceHtmlUrl":130},"examples\u002Fgeneral-comms.md",602,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fenterprise-communication\u002Finternal-comms-anthropic\u002Fexamples\u002Fgeneral-comms.md",{"path":132,"resourceType":132,"resourceTypeDesc":133,"sizeBytes":134,"sourceHtmlUrl":135},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-identity-governance-lifecycle-process\u002FLICENSE",{"path":137,"resourceType":132,"resourceTypeDesc":133,"sizeBytes":138,"sourceHtmlUrl":139},"LICENSE.txt",11357,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fenterprise-communication\u002Finternal-comms-anthropic\u002FLICENSE.txt",{"path":141,"resourceType":115,"resourceTypeDesc":116,"sizeBytes":142,"sourceHtmlUrl":143},"references\u002Fapi-reference.md",2172,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-identity-governance-lifecycle-process\u002Freferences\u002Fapi-reference.md",{"path":145,"resourceType":146,"resourceTypeDesc":147,"sizeBytes":148,"sourceHtmlUrl":149},"scripts\u002Fagent.py","SCRIPT","脚本",6997,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-identity-governance-lifecycle-process\u002Fscripts\u002Fagent.py",[151,176,200,227,253,280],{"skillNo":152,"name":153,"nameZh":6,"description":154,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":155,"categories":156,"keywords":158,"publishedAt":41},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[157],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[159,160,161,162,163,40,164,25,36,165,166,167,168,169,170,171,172,173,174,175],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":177,"name":178,"nameZh":6,"description":179,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":180,"categories":181,"keywords":183,"publishedAt":41},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[182],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[184,172,185,186,163,187,40,36,188,189,190,191,192,193,194,195,196,197,198,199],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":201,"name":202,"nameZh":6,"description":203,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":204,"categories":205,"keywords":210,"publishedAt":41},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[206,209],{"categoryNo":207,"categoryName":208,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[194,211,212,213,214,40,215,216,188,27,217,218,219,220,221,222,223,224,225,226],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":228,"name":229,"nameZh":6,"description":230,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":231,"categories":232,"keywords":234,"publishedAt":41},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[233],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[235,236,237,40,238,239,240,241,242,243,244,245,246,247,248,249,191,250,251,252],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":254,"name":255,"nameZh":6,"description":256,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":257,"categories":258,"keywords":260,"publishedAt":41},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[259],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[261,262,263,40,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":281,"name":282,"nameZh":6,"description":283,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":284,"categories":285,"keywords":287,"publishedAt":41},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[286],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[163,288,40,289,290,291,292,293,294,295,296,222,297,223,298,299,300,301,302,303],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]