Least privilege
Everyone keeps admin, just in case. Oak takes it back.
Oak cuts the access people don't use, makes what's left just-in-time, and builds roles from how your org actually works, so least privilege stays least privilege.
Book a demo →183 of 214 grants in Finance Ops haven't been used in 90 days, and 6 people hold standing admin.
Resolved. 183 unused grants removed. Admin is now eligible: approved on request, expiring on its own. Logged.
What we hear
Access piles up. Nobody can say what's needed.
It never comes back
Three years ago, they needed to give themselves owner. Three years later, they still have it.
IT services leader
Approvers can't tell
Whoever is doing the approval for access oftentimes lacks that context of, does this person truly need this?
Identity strategy, telecom
Roles exploded
We have roughly 60,000 groups, even though we only have 85,000 people.
Identity engineering, technology
What changes
Not who can have access. Who should.
Every identity holds more than it uses. Oak reads real activity across your apps, so unused access goes, sensitive access waits until it's needed, and what's left fits the work. Drag to compare.
Right-size · Eligible · Mine · Keep
From standing access to least privilege that sticks.
01
Cut what isn't used
Every grant shows when it was last used. Oak removes what isn't, directly where you grant write access or through a ticket, and checks the app every hour until it's done.
02
Make the rest just-in-time
What stays, sensitive access above all, becomes eligible instead of standing, in any app where it matters. People request it when they need it, an approver says yes, and it expires on its own.
03
Mine roles from your org
Oak starts from your departments, teams and titles, then refines with what people actually use. Adjust the proposal, watch the impact recalculate, and approve it as one campaign.
04
Keep it true
As people join, move and leave, Oak re-mines the model, so least privilege doesn't drift back. Reviews are scoped from it, so reviewers certify only what matters.
| App | Permission | Last used | |
|---|---|---|---|
| Snowflake | Read finance schema | 1 hour ago | In use |
| GitHub | Repo admin | Never | Removed |
| Salesforce | Edit opportunities | 2 days ago | In use |
| Salesforce | Modify all data | Never | Removed |
| Entra ID | Global reader | 140 days ago | Removed |
Tom Ortiz requests AWS prod-admin for 4 hours
Reason: INC-4471 · Eligible through Finance Ops · Approver Maya Chen
StatusReady to approve| Role | Change | People | |
|---|---|---|---|
| Finance analyst | No drift | 24 | In sync |
| Finance approver | 2 unused | 9 | Re-mined |
| Sales ops manager | Mover | 5 | Flagged |
| Finance admin | Now eligible | 6 | Eligible |
See it in your estate
See what your people hold, and what they actually use.
Bring one app. We'll show you its unused access, its standing admin and the roles hiding in it.
Book a demo →Why Oak
Least privilege, not a one-off cleanup.
Roles from your org, not workshops
Oak mines roles from your HR structure and real use, and the same model drives right-sizing, just-in-time and review scope.
Activity, not assumptions
No one else has an activity-based identity graph. Not only who has access, but who should.
It closes the loop
Unused access is removed directly where you grant write access, or through Jira or ServiceNow.
Your team approves every change
Oak's agents do the work. Every change is phased, reversible and on record.
“Role mining, or role engineering, it's always a continuous process.”
IAM leader, payments
Connects anything
Access lives everywhere. So does Oak.
Oak reads real activity across cloud, SaaS, on-prem and homegrown apps. If it has identities inside, Oak reaches it.
And hundreds more, with new ones built in days.
Start with least privilege. Keep going.
The same graph governs everything else.
The model that right-sizes access also scopes your reviews and governs your agents.
Questions, answered.
How does Oak decide what access isn't needed?
From real activity. Oak reads usage across your apps and shows each grant with when it was last used, so cuts are based on what people do, not on what a role says they could do.
Will Oak remove access without our approval?
No. Oak recommends, your team approves, and every change is phased, reversible and on record.
We already have JIT in our PAM or IdP. Why Oak?
Oak doesn't replace your vault. It cuts what's unused and keeps roles true, so less access is standing in the first place, and what must exist becomes eligible instead.
How is Oak's role mining different?
It starts from your org structure (departments, teams and titles) and refines it with entitlements and real use. Roles mirror how the business works, and Oak keeps them true as it changes, instead of running a one-off project that drifts.
Do we need to replace our IGA?
No. Oak works alongside the IGA you run today and brings least privilege to the apps and identities it leaves out.
Least privilege doesn't have to drift. Make it stick.
Access cut to what's used, admin on request, and roles that stay true as your org changes.
Book a demo →