iShield Solutions Series, Security, Risk & Compliance · Identity
Workforce Identity, Access & Trust (IGA + PAM)
Access That Follows the Person, from First Day to Last
Workforce Identity, Access & Trust makes the employee record the trigger for access: joiner, mover and leaver events start provisioning, reviews and revocation across connected applications, and every exception has an owner and an end date.
Workforce JML, access reviews, privileged sessions and SoD enforcement on one fabric.
Who leads, who contributes
- LeadiShield Link
- ContributoriShield Nexus
- ContributoriShieldGRC · iShield GRC Ltd.
Connection to existing identity providers and privileged-access tools, access-review orchestration, conflict detection and just-in-time elevation.
The enterprise challenge
Access is granted in minutes and removed in months.
New starters wait for access while leavers keep it. Movers accumulate rights from every role they have held, and privileged accounts are shared because requesting temporary elevation takes longer than the task. None of this is visible until a review or an incident.
Workforce identity is a governance problem with HR as its source of truth. The employee record should decide what access a person needs; the identity tools already in place should carry it out; and every deviation should be a decision someone owns.
Where iShield Nexus contributes
iShield Nexus contributes the people events that start the access lifecycle (People Services) and the access exceptions and evidence (Risk & Compliance). iShield Link leads identity and privileged-access brokering; iShieldGRC is listed for segregation-of-duties assurance.
The Nexus angle
Joiner, mover and leaver events must reach access processes reliably.
- Technology services and controls are managed apart from the business process
- Evidence and ownership are fragmented
Solution overview. Govern workforce identity end-to-end: Joiner-Mover-Leaver from HR, access reviews, role mining, SoD enforcement and privileged session brokering — integrated with Entra ID, Okta, Ping, SailPoint, CyberArk and BeyondTrust through Link. Customer identity is a separate solution (see CIAM).
Buyer challenges
Leavers who keep access
Termination reaches payroll quickly but reaches the long tail of applications slowly, leaving active accounts behind.
Movers who accumulate rights
Role changes add new access without removing the old, until a single account can raise and approve the same payment.
Reviews that rubber-stamp
Managers approve long lists of entitlements they do not understand, so the review produces a signature, not a decision.
Standing privilege
Administrative rights are held permanently because elevating on demand is slow and leaves no useful record.
Decision owners
- HR operations
- The authoritative joiner, mover and leaver event and its effective date.
- Line manager
- Whether access beyond the role baseline is justified, and for how long.
- Identity and security lead
- Role baselines, privileged-access policy and conflict rules.
- Risk owner
- Whether a segregation-of-duties conflict is removed or accepted with compensating control.
Who leads, who contributes, and where each stops
This is a cross-product solution. Each platform keeps its own responsibility and boundary; none is presented as a module of another.
- iShield LinkLead
Owns
Connection to existing identity providers and privileged-access tools, access-review orchestration, conflict detection and just-in-time elevation.
Boundary
Brokers the organization's existing identity tools rather than replacing them; it does not decide who should have access.
- iShield NexusContributor
Owns
Employee journey events from People Services and owned, time-bound access exceptions with evidence in Risk & Compliance.
Boundary
Does not provision accounts in target applications or hold role baselines.
- iShieldGRC (iShield GRC Ltd.)Contributor
Owns
Segregation-of-duties assurance over financial reporting through ICFR / SOX Compliance Management.
Boundary
The composition also lists Identity Governance & Administration under iShieldGRC, which is not among its published capabilities and awaits attribution.
Module responsibilities
| Module | Platform | Responsibility in this solution | Hands on |
|---|---|---|---|
| People Services | iShield Nexus | Raises onboarding, role-change and offboarding journeys from the employee record. | Joiner, mover and leaver events |
| Risk & Compliance | iShield Nexus | Records access exceptions with owner, compensating measure and expiry. | Exception decisions and evidence |
Published composition, by owning platform
The modules in the solution's published composition, grouped by the platform that owns them.
iShieldGRC
Why this composition
Workforce identity (IGA + PAM) is a SoX/SoD problem with HR as the source of truth — distinct from customer identity. People Services drives JML, Risk & Compliance enforces access controls, and Link brokers existing Entra / Okta / Ping / SailPoint / CyberArk so investments stay and gain a governance layer.
Cross-platform journey
One person, three moments, every access decision on the record
Follow an employee across the joiner, mover and leaver moments. The timeline runs left to right; each step shows which module acts and what is recorded.
- Joiner event · People Services iShield Nexus
- Provision · IdP Connector iShield Link
- Check conflicts · SoD Conflict Detector iShield Link
- Mover event · People Services iShield Nexus
- Own the exception · Risk & Compliance iShield Nexus
- Elevate just in time · Just-in-Time Access Broker · PAM Broker iShield Link
- Review · Access Review Orchestrator iShield Link
- Leaver event · People Services iShield Nexus
Stage 1 of 8 · iShield Nexus Joiner event
The onboarding journey starts from the HR record and requests the role's baseline access.
- Decision
- HR confirms the start date and role.
- Exception path
- A start date change re-times every dependent task.
- Recorded as
- Onboarding journey with access request
Next: Provision in IdP Connector (iShield Link) — the work passes to another platform
This journey shows how responsibilities are intended to divide between the platforms. It describes an operating model, not a pre-built integration between them.
Decisions, exceptions and who owns them
Access exceptions are owned and time-bound.
| Decision | Accountable owner | Evidence recorded | Exception path |
|---|---|---|---|
| Grant access beyond the role baseline | Line manager | Request with justification and end date | Requests without an end date are returned to the requester. |
| Accept a segregation-of-duties conflict | Risk owner | Conflict finding with compensating control | The exception expires and returns for decision. |
| Elevate privileged access | Approver named in policy | Task, period and recorded session | Elevation outside policy is declined and logged. |
| Confirm access in a review | Line manager | Review decision per entitlement | Unanswered items escalate rather than being approved by default. |
How access controls are mapped
Role baselines and conflict rules are defined by the organization's identity and risk owners and held as policy. Nexus records exceptions against those policies; it does not ship a pre-built role model or conflict library.
- Every exception names the policy it departs from, its owner and its expiry.
- Conflict rules are maintained by the risk function and versioned when roles change.
- Which controls are tested for financial reporting is decided in iShieldGRC by the control owner.
Regulatory context
Regulations and frameworks organizations in this domain commonly work with. Listed as context for planning, not as a certification, attestation or pre-built mapping.
Intelligence in explicit modes, by platform
Nexus AI capabilities assist the people involved; decisions remain with accountable owners.
- Assistance drafts, answers or summarizes
- Recommendation proposes for a person to accept
- Predictive anticipates or flags
- Workflow-triggered runs only as configured and approved
HR answers
AssistanceAnswers common onboarding and role-change questions from knowledge.
People Services — HR answersEvidence mapping
RecommendationSuggests exception and journey records as evidence for access controls.
Risk & Compliance — Evidence mapping
Recognized practice behind the operating model
Mappings describe how the operating model aligns with recognized practice. They are not attestations or certifications.
The access lifecycle supports the identity, access and access-rights controls of ISO/IEC 27001:2022 Annex A, which the accepted Risk & Compliance page maps at the level of risk assessment and treatment. Annex A control-level references describe practice the solution supports, not an attestation.
| Framework | Practice | How the solution operates | Relationship |
|---|---|---|---|
| ITIL 4 | Service Desk and workforce practices | Joiner, mover and leaver journeys are delivered as coordinated employee services.Mapped on the accepted People Services page. | Aligned practice |
| ISO 31000:2018 | Risk treatment and review | Conflicts and exceptions are treated, accepted with compensating control, or removed.Mapped on the accepted Risk & Compliance page. | Compliance-supporting capability |
What changes for the organization
Outcomes are described qualitatively. Figures are published only once evidenced.
Access that ends on the last day
Offboarding starts from the HR record, and active access after the date is investigated.
Movers without accumulated rights
Role changes remove what the old role needed unless an owner justifies keeping it.
Reviews that mean something
Managers confirm fewer, better-explained entitlements, and silence escalates.
Privilege on demand
Elevation is tied to a task and period, and the session is on the record.
What sets this solution apart
HR as the trigger
The employee journey, not a ticket, starts every access change.
Exceptions with an end date
Every deviation is a decision with an owner and expiry, not a silent standing grant.
Delivery and industry context
Planning information carried over from the solution record.
30 / 60 / 90-day value plan
Days 0–30 — Foundation
Stand up the iShield workspace, integrate sources of truth, ingest baseline data.
- Tenant provisioned in chosen region (KSA / UAE / EU / US)
- SSO + RBAC mapped to enterprise identity (Entra ID / Okta)
- Top 5 integrations connected and reconciled
- Baseline KPIs measured before any change
Days 31–60 — Activation
Turn on automation, AI agents and guardrails for the priority value stream.
- Workflows live for the top 3 use cases
- Link AI agents enabled with explicit guardrails and approvals
- Power-user enablement and admin training complete
- First measurable KPI improvement vs baseline
Days 61–90 — Scale
Industrialize, roll out to additional teams, prove ROI to the steering committee.
- Solution rolled out to additional business units / geos
- Executive dashboard with target vs actual outcomes
- Continuous improvement backlog established
- Signed ROI memo and renewal / expansion plan
Personas served
Illustrative industry scenarios
Representative situations by industry. Regulations named here are context, not certifications or commitments.
Energy, Oil & Gas
Workforce Identity, Access & Trust (IGA + PAM) extended to OT estates via iShield Link OT bridge.
Public Sector (KSA Vision 2030 / UAE Digital Government)
Workforce Identity, Access & Trust (IGA + PAM) delivered on sovereign cloud with NCA / TDRA alignment.
Healthcare
Workforce Identity, Access & Trust (IGA + PAM) with HIPAA / NPHIES-aware data flows and PHI guardrails.
Related Security, Risk & Compliance solutions
Integrated GRC & Audit
One control library and one evidence record for audit and assurance across the frameworks your organization adopts.
OpenSecurity Operations & Threat Response
SOC, IR, vulnerability and threat intel on one workspace — SIEM-agnostic, AI-assisted.
OpenOperational Resilience & Business Continuity
DORA, NIS2 and ISO 22301 aligned — BIA, plans, exercises, crisis and infra DR in one engine.
Open
