Introduction

To choose an identity governance platform, write and weight your requirements first, then score every vendor on the same rubric before any demo. Connector coverage carries the most weight, followed by lifecycle automation, certification depth, identity coverage, and remediation at the source.

Then test the shortlist on your hardest application rather than a clean sandbox, and confirm the vendor can run the rollout.

Access is the attack surface that matters. Verizon's 2026 Data Breach Investigations Report found credential abuse in the attack chain of 39% of breaches.

This checklist sits on the blog of Oak, the AI-native identity operating system. The criteria hold for any platform you evaluate, and no vendor is ranked here.

Key takeaways

• Write and weight your requirements before you sit through any vendor demo.
• Connector coverage and identity data quality deserve the highest weight.
• Service accounts, machine identities, and AI agents are now core selection criteria.
• Require remediation at the source, not detection that only reports risk.
• Oak works beside the identity governance platform you run, across every identity type.

What identity governance and administration covers

Identity governance and administration (IGA) makes sure the right identities hold the right access, and that every grant can be reviewed and proven to an auditor. Administration handles provisioning and deprovisioning, and governance adds policy, review, and certification.

Most IGA work follows the joiner-mover-leaver (JML) lifecycle. Gaps in the leaver step are where standing access piles up.

A few terms recur in every evaluation:

• Access certification. The review that confirms whether each identity should keep the access it holds.
• Access review. A single certification cycle where managers or resource owners approve or revoke entitlements.
• Entitlement management. Defining, granting, and tracking the fine-grained permissions an identity holds inside each application.

Modern IGA also has to cover identities no manager owns. Oak governs service accounts and AI agent identities in the same graph as people.

CategoryWhat it governsThe question it answersIGAWho and what has access, and whether it is appropriateShould this identity have this access?IAMAuthentication and single sign-onIs this identity who it claims to be?PAMPrivileged and administrative credentialsIs this privileged session controlled and recorded?

Buy, extend, or add to what you run

Building your own is rarely wise. Few teams can hand-roll a certification engine, a policy model, and dozens of connectors, then keep them running.

Four drivers settle the decision. They are application estate complexity, regulatory load, the volume of service accounts and AI agents, and your team's capacity to run the program.

Already running an IGA? Cover what it cannot reach first, because Oak lands beside the IGA and identity provider you already run, with a team that builds the connectors for the systems they never reached.

The buyer's checklist for an identity governance platform

Score every vendor against weighted criteria, so one strong demo cannot hide a weak foundation.

CriterionWeightWhat to verifyConnector coverage and data qualityHighestHow each connector ingests real accounts and fine-grained entitlements from your systemsLifecycle (JML) automationHighHow joiner, mover, and leaver events trigger grants and full revocationAccess certification depthHighWhether reviews run continuously with usage context, or only quarterlyService account, machine, and AI agent coverageHighHow every identity type is discovered, owned, and reviewedRemediation at the sourceHighWhether risk is revoked in the source system, with proof, or only flaggedRoles and segregation of dutiesMediumHow conflicts across applications are detected and blockedDeployment flexibilityMediumWhether SaaS, hybrid, and data residency needs are metOperability and total costMediumImplementation, connector work, and internal staffing to run it

Test the mechanism behind each criterion. A quarterly campaign only samples a moment, while Oak's Identity Risk Visibility & Intelligence continuously correlates what every identity can access with what it actually uses.

Quarterly reviews tell you what happened, never what is happening.

Identity volume is why the checklist changed. The 2026 Identity Security Landscape survey put machine identities at 109 for every human.

Ask each vendor how it handles a service account whose owner has left, and one that holds far more access than it uses.

What to require in a proof of concept

Run the proof of concept on your worst application, not the demo tenant. Pick the system with the ugliest entitlement model, because that is where platforms fail.

Require the vendor to prove four things end to end:

• Ingest fine-grained entitlements from that hard application.
• Run a real certification campaign with your actual reviewers.
• Revoke flagged access at the source, with proof it happened.
• Discover the service accounts and other non-human identities hiding in that system.

Time the connector build while you watch. Any connector engine, Oak's ConnectAny included, should show its reach on your homegrown application rather than describe it on a slide.
‍

{{small-cta}}
‍

RFP questions to ask

Keep the RFP on mechanism and evidence rather than feature checkboxes:

• How do you support our specific systems today, including on-prem and homegrown ones?
• How do you drive identities from our authoritative HR source?
• How do you add last-used and usage context to access reviews?
• How do you revoke access at the source, and what proof do we get?
• How do you detect and block segregation of duties conflicts across applications?
• How do you discover, own, and offboard service accounts and AI agents?
• How do you sequence implementation, and who does the connector work?

How to frame the return on governance automation

Frame the return around avoided breach cost and shorter risk windows. IBM's Cost of a Data Breach Report 2026 put the global average breach at a record $4.99 million, up 12% on the prior year.

The same report found that organizations using AI and automation saved an average of $1.93 million per breach.

Total cost of ownership is more than the license. Add implementation, connector development, and the internal hours it takes to run the program.

Oak publishes no pricing, so model that total cost with the team on a demo call.

Conclusion: turning the checklist into a decision

A good choice leaves you able to answer who and what can reach every system, and to fix it at the source, on the day an auditor asks. The identity governance platform that gets you there is rarely the one with the best demo.

Oak gives you that answer from one live graph, beside the IGA you already run. It continuously correlates what every identity can access with what it actually uses, then routes risk-prioritized decisions to the right reviewers.

Bring your hardest application and your connector list, and book a demo with Oak to test it against the checklist above.

Frequently asked questions

Who should be involved in choosing an identity governance platform?

Choosing an identity governance platform works best with the IAM lead, the owners of your hardest applications, internal audit or compliance, and security operations in the room. Application owners know where entitlements are messy, and audit knows what evidence will be asked for. Bring the owner of your hardest application to an Oak demo.

How much does an identity governance platform cost?

Identity governance platform pricing varies by identity count, connectors, and modules, so ask each vendor for a written quote. Budget beyond the license for implementation, connector work, and internal staffing, which often exceed the software. Oak publishes no pricing, so cost gets discussed directly with the Oak team through a demo request.

How long does an identity governance implementation take?

An identity governance implementation can take weeks or many months, depending on your application estate, data quality, and connector complexity. Messy legacy systems and dirty identity data are a common bottleneck, so ask for a phased plan and time a real connector build. Oak publishes no implementation timeline for a full estate, so raise it with the team behind Oak.

When is an identity provider's governance module enough instead of an identity governance platform?

An identity provider's governance module can be enough when the estate is small, mostly cloud, lightly regulated, and built around that provider's own applications. A dedicated identity governance platform is needed for on-prem or custom systems, strict audit demands, segregation of duties across applications, or many service accounts and AI agents. Oak connects to both.

What are the most common mistakes when choosing an identity governance platform?

The most common mistakes when choosing an identity governance platform are demoing only the vendor's clean sandbox, underweighting connector coverage, ignoring service accounts and AI agents, and accepting detection without remediation. Another is forgetting that total cost includes implementation and staffing. Score every vendor, Oak included, on the same weighted rubric before any demo.

‍