Identity Governance and Administration (IGA) governs identity life cycles, entitlements, access requests, approvals, provisioning, and periodic access certifications. It answers who has access, who approved it, when access should be reviewed, and whether it remains appropriate. section 14.4
IGA supplies authoritative identity data, life-cycle state, approvals, and entitlement assignments. Policy governance interprets those inputs at runtime, while decision logs and review findings feed entitlement cleanup, certifications, and policy updates. section 14.4 section 14.9
Common IGA capabilities include:
- Joiner–mover–leaver workflows that provision employees and adjust access as roles change. section 14.4
- Entitlement management through application access assignments and group memberships. section 14.4
- Periodic certifications that review assigned access and its continuing appropriateness. section 14.4
- Auditable coordination with policy owners, reviewers, approvers, operations, and auditors. section 14.9
Contractor access after project closure
An access review found contractors retaining engineering collaborator entitlements after their projects ended. Runtime decision logs showed inherited relationships still contributing to authorization. IGA removed the outdated entitlements, while policy governance required active project membership for continued access. section 14.4
