Lifecycle automation
People move. Access follows.
Oak runs joiners, movers and leavers from policies built on your real role model, so new hires are ready on day one, movers lose what the old team needed, and leavers lose everything, in every app.
Book a demo →Ben Cole left 21 days ago and still holds 46 grants in 9 apps. 6 tickets are open.
Resolved. 46 grants removed in 9 apps within the hour. Verified in each app, approved and logged.
What we hear
HR says they left. The apps never heard.
- Salesforce Active
- AWS Active
- Billing portal Active
Leavers keep their access
What about the 6,000 entitlements they've accumulated over 16 years? We manually ticket every production admin to go check their system and remove access.
Head of assurance, financial exchange
Movers keep the old team's access
Least privilege is a moving target, specifically when we have joiners, movers, leavers.
Identity initiatives, telecom
OctNovDec
JML audit findings this quarter: 4Audits find it first
Most SOX audit findings relate to the JML component.
CISO, manufacturing
What changes
Not a ticket per app. One policy, every app.
When someone leaves, every app they touched needs to hear about it. By ticket, that's weeks of chasing. By policy, Oak removes everything at once, checks each app, and keeps the record. Drag to compare.
Detect · Build · Apply · Prove
From HR event to every app, on record.
01
Start from HR
Joiners, movers and leavers are picked up from your HR system the moment they happen.
02
Policies from your real roles
Oak builds lifecycle policies from your mined role model, not hand-written rules, and keeps them current as your org changes.
03
Every move, handled
New hires get the right access on day one. Movers lose what the old team needed and get the new team's. Leavers lose everything, in every app.
04
Approved and on record
Your team approves. Oak applies the change directly where you grant write access or through a ticket, checks each app, and logs every action.
| Person | Event | Team | |
|---|---|---|---|
| Ana Ruiz | Joiner | Finance | Policy ready |
| Tom Ortiz | Mover | Sales Ops | Needs approval |
| Ben Cole | Leaver | Finance | Applied |
| Leo Park | Joiner | Platform | Done |
StatusActiveTom Ortiz moved from Finance to Sales Ops
12 grants added from the Sales Ops policy · 9 Finance grants removed · 6 apps
| App | Grant | Time | |
|---|---|---|---|
| Salesforce | Admin | 09:02 | Removed |
| AWS | prod-read | 09:03 | Removed |
| Billing portal | Approver | 09:09 | Removed |
| HR database | Read salaries | 09:11 | Removed |
See it in your estate
Pick your last leaver. We'll show you what's still open.
Bring one departure. We'll show every app that person could still reach, and how a policy closes it.
Book a demo →Why Oak
Lifecycle that keeps itself current.
Policies from your real roles
Built from the mined role model, so they reflect how people actually work, and stay current as your org changes.
Every app, not just the IdP
Cloud, SaaS, on-prem and homegrown apps, in the same policy, on the only activity-based identity graph.
It closes the loop
Changes are applied directly or through Jira or ServiceNow, then checked against each app.
Your team approves every change
Oak's agents do the work. Every change is explained, reversible and on record.
“When employees leave, the primary authenticators get killed automatically. But what about the 6,000 entitlements they've accumulated over 16 years?”
Head of assurance, financial exchange
Connects anything
People work everywhere. So does Oak.
HR systems, cloud, SaaS, on-prem and homegrown apps, all in the same lifecycle policy.
And hundreds more, with new ones built in days.
Start with lifecycle. Keep going.
The same graph governs everything else.
The role model that runs your lifecycle also right-sizes access and scopes your reviews.
Questions, answered.
Where do lifecycle events come from?
From your HR system. Joiners, movers and leavers are picked up as they happen, and the matching policy runs.
Do we have to write the lifecycle rules?
No. Oak builds lifecycle policies from your mined role model and keeps them current as your org changes. You can adjust any policy before it runs.
What happens when someone moves teams?
Oak removes the access the old team needed and grants what the new role needs, in every app, with your team approving.
Does it cover apps beyond our IdP?
Yes. The same policy runs across cloud, SaaS, on-prem and homegrown apps connected to Oak.
Will Oak change access without our approval?
No. Your team approves, and every change is explained, reversible and on record.
Do we need to replace our IGA?
No. Oak runs next to the IGA you have, or in its place.
Day one ready. Day one gone.
Access that follows people as they join, move and leave, in every app, on record.
Book a demo →