idGenius platform

Three classes. Five traits. One schema.

Each source keeps its native shape. New entity types resolve at query time — no ETL program, no migration, no integration spend.

Business capability

Daily settlement

Governed
Service accountokta:svc-settlement
Cloud workload identityaws:role/settle-exec
Kubernetes accountk8s:sa/prod/settle
API credentialvault:kv/settle/api
AI agentagents/ai-031
OWNERa.reyes · PaymentsLIFECYCLEExpires with Contract C

Illustrative object. Five credentials, one owned business capability.

WORKFORCEPeopleEmployees, contractors and consultants. Contingent workers, vendors, suppliers and partners.
MACHINEMachinesService accounts, machinery and OT, devices — every workload with a verifiable identity.
CONTEXTOrganizations & digital entitiesOrganizations, projects, platforms, applications, data and documents.

AI agents connect across all three — people, machines, and organizations and digital entities.

Three identity worlds

Humans are no longer the majority.

idGenius governs all three worlds in one context model. AI agents connect across every one of them.

Human IdentityPeople, roles, privilegePeople, privileged accounts and roles — with their real business owner.Human identities4,120
Non-Human IdentityWorkloads, APIs, agentsService accounts, workloads, tokens, keys and autonomous AI agents.NHI credentials18,204
Third-Party IdentityVendors, delegated accessVendors, contractors and cross-organisation integrations.Vendor relationships214

Illustrative proportions. One schema, three worlds, one audit trail.

Identity bundling

Scattered credentials become one owned capability.

From complexity

Thousands of credentials, scattered across sources and named differently in each one.

AWSAzureKubernetesSnowflakeDatabricksOkta
Through bundling

Related identities converge into one owned group with a business meaning.

okta:svc-settlementaws:role/settle-execk8s:sa/prod/settlevault:kv/settle/apiagents/ai-031
To clarity

One governance object with an owner, a criticality and a lifecycle.

Business capability
Settlement pipeline
5 identities→ 1 governance object
owner a.reyes · critical · certified 2026-06-30

Illustrative. Owner, policy, lifecycle and audit trail attach to the bundle, not to each key.

Five traits, every object
sales-orchestrator-agentEphemeral Access Grant • Expires in 14m
01OwnerEmployee D · Project B
02LifecycleActive · expires with Contract C
03PolicyAgent data-access v4 · clause 4.2
04Relationships7 resources · 2 sub-agents
05Audit trail182,410 entries · SIEM-streamed

Illustrative object. The same five traits attach to a human, a workload or a vendor.

Integration surface

2,000+

Years of ETL and millions of dollars — or read it where it already lives.

Native integrations · discovery

Every category. Every vendor.

idGenius integrates with the categories and vendors below for discovery — read in place, no migration, resolved into one schema.

HR / HCM
IAM
IGA
PAM
Secrets and machine credentials
AI platforms and LLM gateways
Cloud platforms
Containers and workload identity
CI/CD and source control
ITSM and CMDB
Endpoints and EDR
SIEM and SOAR
Third-party risk and GRC
Nonemployee and vendor management
Contract lifecycle
ERP and procurement
CRM
Documents and collaboration
Data warehouses
FinOps and cloud cost
Project management
INTEGRATES WITH
HR / HCM
WorkdaySAP SuccessFactorsADPUKGBambooHRRippling
IAM
OktaMicrosoft Entra IDAuth0PingRSAOneLoginJumpCloudAD / LDAP
IGA
SailPointSaviyntRSAOmadaOne IdentityEntra ID Governance
PAM
CyberArkBeyondTrustDelineaHashiCorp Vault
Secrets and machine credentials
HashiCorp VaultAWS Secrets ManagerAzure Key VaultGCP Secret ManagerConjur
AI platforms and LLM gateways
OpenAIAnthropicAzure OpenAIAmazon BedrockVertex AIPortkeyLiteLLM
Cloud platforms
AWSAzureGoogle Cloud
Containers and workload identity
KubernetesAWS IRSAAzure Workload IdentityGCP Workload Identity
CI/CD and source control
GitHubGitLabJenkinsAzure DevOps
ITSM and CMDB
ServiceNowJira Service ManagementFreshserviceZendeskDevice42
Endpoints and EDR
CrowdStrikeSentinelOneMicrosoft DefenderTaniumQualysTenable
SIEM and SOAR
SplunkMicrosoft SentinelIBM QRadar
Third-party risk and GRC
OneTrustPrevalentProcessUnityArcherUpGuardSecurityScorecardMetricStream
Nonemployee and vendor management
SAP FieldglassBeelineCoupaUtmostPeopleFluent
Contract lifecycle
DocuSign CLMIroncladSAP Ariba Contracts
ERP and procurement
SAP S/4HANANetSuiteDynamics 365CoupaAribaJaggaer
CRM
SalesforceHubSpotDynamicsZohoPipedrive
Documents and collaboration
SharePointGoogle DriveBoxDropboxDocuSignExcelGoogle Sheets
Data warehouses
SnowflakeDatabricksBigQueryPostgresMySQLMSSQLRedshift
FinOps and cloud cost
AWS Cost ExplorerAzure Cost ManagementCloudHealthCloudability
Project management
JiraAsanaMonday.comSmartsheetClickUpLinear
Read-only discovery. Native nodes where they exist, API and webhook connections everywhere else.
The shared identity layer

One graph. Eleven entity classes. Live risk on every edge.

Triple store plus streaming ingest — the graph is the state, not a nightly snapshot.

idGenius · Access relationship graph11 CLASSES · 3 RELATIONSHIPS
Every class idGenius governs
idGeniusShared Identity
Identitiescan act
Resourcesare acted upon
Contextauthorizes the action
Humans
Machines · AI agents
Third parties
Applications
Data
Endpoints
Platforms
Organizations
Projects
Contracts
Policies
idGenius
Shared IdentityOne schema resolves all eleven
Identitiescan act
Humans
Machines · AI agents
Third parties
Resourcesare acted upon
Applications
Data
Endpoints
Platforms
Contextauthorizes the action
Organizations
Projects
Contracts
Policies
The runtime request

One request. Deeply answered.

AuthZEN asks the question. idGenius fills the context that makes the answer meaningful.

WITHOUT CONTEXT
subject = Agent123action = readresource = Document456
Three strings. Nothing about ownership, purpose, policy or risk.
WITH THE RELATIONSHIP GRAPH

Agent 123 — owned by Vendor A, acting for Project B, under Contract C, authorized by Employee D, accessing sensitive customer information, for a stated business purpose, under applicable policy — with current risk = X.

Capability cycle · the APIs

Every stage, exposed as an API.

idGenius · Capability cycle03 GOVERN
ONE LAYER01Discover02Learn03Govern04Enforce05Observe06AuditidGenius
01Discover

Find every entity. Connectors and inventory, read in place.

Identity security platforms
Applications and data
Endpoints and platforms
Third parties and contracts
02Learn

Critical relationship mappings — what it is, what it reaches, what it risks.

People and organizations
Endpoints and platforms
Applications and documents
The mapping consultants bill for
03Govern

Owner, policy and lifecycle bound to every object.

Named accountable owner
Policy from source documents
Lifecycle state
Conflicts surfaced as they arise
04Enforce

Decisions at your existing enforcement points.

AuthZEN contract
OAuth and SCIM
SPIFFE and SPIRE
No proprietary SDK
05Observe

Central intelligence. Maintains the graph, computes live risk, drives reaction.

Streaming ingest
Edges re-weighted on every signal
Live risk = X
No nightly snapshot
06Audit

Sponsored, approved, reached, expired — one trail per action.

Identity ledger
Policy citations
SIEM streamed
Cost provenance
Select a stage on the ring

Every decision traces to its evidence, with a cost-provenance record on every action.

Govern Once. Enforce Everywhere.

One policy, published to every enforcement point.

idGenius · Policy distributionAUTHORED ONCE
idGeniusAgent data-access policyv4 · authored once in idGenius
IAM / SSO
IGA
PAM and vaults
Cloud and Kubernetes
LLM gateways
API gateways
SIEM and SOAR
Agent data-access policyv4 · authored once in idGenius
✓IAM / SSO
✓IGA
✓PAM and vaults
✓Cloud and Kubernetes
✓LLM gateways
✓API gateways
✓SIEM and SOAR

No proprietary SDK at the enforcement point — the contract is the integration.

Open standards

Standard pipes. idGenius composes the context.

OAuthToken and delegation flowAgent to agent, service to service — delegation that carries its grant.
SPIFFEWorkload identityEvery workload gets a cryptographic, verifiable identifier — the SVID.
SPIRERuntime issuanceSPIRE mints those identities. idGenius is the trust root it draws from: identity sources, governance and attestations inherited through the graph.
SCIMProvisioning and lifecycleJoiner, mover, leaver — inherited, then extended with owner, policy, relationships and audit trail.
MCPThe AI handshakeModels call tools and idGenius sits in the middle, so identity context rides the call instead of a separate handshake.
DID · VCExternal and federated actorsDecentralized identifiers and verifiable credentials for actors outside your directory.
AuthZENThe authorization contractThe enforcement point asks; idGenius returns decision, context, policy citations and obligations.

No proprietary SDK at the enforcement point — the contract is the integration.

Architecture

Boring on purpose. Read at the bottom, decide at the top.

Five tiers. Every one of them a standard you already operate.

05
EvidenceOne record per action, streamed out
Identity ledgerPolicy citationsSplunk · SentinelCost provenance
04
EnforcementDecisions at the points you already run
AuthZENOAuth · SCIMSPIFFE · SPIREMCP
03
IntelligenceThe graph is the state, not a snapshot
Graph databaseTriple storeLive risk engineRelationship ontology
02
IngestStreaming, read-only, schema on read
Kafka streamingPostgresKubernetesOpen-source SDKs
01
SourcesRead in place — nothing migrated
Okta · Entra IDWorkday · SCIMAWS · Azure · GCPServiceNow · CMDB

Nothing proprietary in the read path and nothing proprietary at the enforcement point. Swap any tier for the product you already own.

Assurance

Every agent. Every action. One trail.

Trust$15MCYBERSECURITY INSURANCEBacked by a $15M cybersecurity insurance policy.
ComplianceSOC 2TYPE II · SCHEDULEDRoadmap to ISO 27001, HIPAA and NIST.
EncryptionBYOKCUSTOMER-MANAGED KMSAt rest and in transit. Bring your own root of trust.
Audit trail1:1RECORD PER ACTIONSIEM-streamed. Replay, reconstruct, prove.
Actor lifecycle

Engage to ReEngage. Governed by one ledger.

Humans run Joiner-Mover-Leaver. AI agents, machines and third parties don't fit that model.

01EngageBirth of an actor. Owner assigned. Policy bound.Discovered automatically — no onboarding ticket.
02ChangeRole and relationships change. Policy re-evaluated live.Policy updates the instant the relationship changes.
03DisEngageDecommissioned. Revocation cascades, sessions terminate — the record persists.Revokes everywhere at once — nothing orphaned.
04ReEngageRenewed two years later. History intact, re-attested against today's policy.Re-attests instantly against current policy.
05Identity LedgerA constant state of governance. No access certification campaigns.The ledger is the product — not a project.
06AuditOne trail. For every event, in every state.The trail is already built when audit arrives.

Governance as a state, not a campaign. Every state change writes to the ledger — including the dormant years — so entitlements never need re-proving on a calendar: no quarterly access certifications, no manual re-attestation drives.

KuppingerCole's 2026 NHI Leadership Compass: JML-based tooling "was never designed to discover, attribute, or govern" machine and third-party identities at scale.

MCP integration

Where MCP and idGenius meet.

Model Context Protocol sits on the wire between models and tools. idGenius sits in the middle — so models ask in context.

MCP is the wire. idGenius is the lightweight AI gateway giving it meaning: every tool call is already routed, authorized and context-enriched — no separate gateway to deploy, license or maintain.

idGenius as AI gateway
MODELThe model asks for a tool, in context — not through a separate handshake.
IDGENIUSIdentity context rides the call: owner, purpose, policy and current risk.
TOOLTools receive rich, governed calls rather than anonymous requests.
LEDGEREvery tool call is routed, authorized and recorded as one action.
Policy from documents

Policy isn't a PDF. It's a runtime.

Source documents become structured policy, and structured policy becomes live decisions on every request.

SOURCEDocumentsMSA and DPA clauses, HR and infosec policy, regulatory text, industry frameworks.No data loss, no LLM hallucination.
PARSEDStructured policySubject, action, resource and condition — citable and traceable.Original text always retrievable.
LIVEDecisionsCited to source, with current risk. Forces and obligations applied, re-evaluated on every signal.Compiled enforcement.

Documented obligations become a runtime all identities inherit. Every decision cites the clause it came from — so an auditor reads policy, not inference.

Book a demo

Book a demo to understand how idGenius can lower risk, control token economics and reduce CapEx and OpEx for AI.

Read-only connections. Nothing replaced, nothing disrupted.
A discrepancy ledger — where the gaps are, what they cost, what to prioritize.
+
Thank you.

Your request is recorded. We reply within one business day.

Something went wrong while submitting the form. Please try again.