{"source":"Reconciled from three independent drafts (Claude, Grok, Perplexity) of the functions and features offered by identity and access management platforms. The Claude draft supplies the structure; equivalent features from the other drafts are merged into it and distinct ones added, so each feature appears once and records which drafts named it.","scope":"Covers identity sources and correlation, lifecycle and provisioning, SSO, MFA and adaptive authentication, groups, roles and authorization, access requests and certification, logging and audit, self-service, and platform operations and exit, with the SIS, HR and ERP remaining systems of record for person attributes and affiliations, applications remaining the record for their own data and business-process access rules, and passwords and MFA factors owned by the identity service.","vendors":["Okta","Microsoft Entra ID","SailPoint","Duo"],"sources":{"C":"Claude draft (uploaded)","G":"Grok draft (uploaded)","P":"Perplexity draft (uploaded)"},"groups":[{"k":"P","name":"Identity Lifecycle","ds":["1","2","3"],"desc":"Builds one person identity from authoritative sources and drives accounts from it."},{"k":"A","name":"Authentication","ds":["4","5","6"],"desc":"Verifies who a person is and issues sessions and tokens to campus applications."},{"k":"R","name":"Authorization and Access","ds":["7","8","9"],"desc":"Decides what each identity may reach and expresses that as groups, roles and policies consumed by applications."},{"k":"N","name":"Access Governance","ds":["10","11"],"desc":"Requests, approves, reviews and proves who has access and why."},{"k":"Y","name":"Self-Service","ds":["12","13"],"desc":"Lets people and support staff resolve routine account tasks without central IT."},{"k":"F","name":"Logging, Audit and Reporting","ds":["14","15"],"desc":"Records identity events and turns them into evidence and security signals."},{"k":"E","name":"Platform","ds":["16","17","18"],"desc":"Integration, security, configuration, operations and exit capabilities of the identity service."}],"domains":[{"n":"1","name":"Identity Sources and Correlation","desc":"Ingests person and affiliation data from systems of record and matches it to a single identity.","area":"Identity Lifecycle","caps":[{"id":"1.1","n":"Connect authoritative sources","herm":["BC139","BC143","BC136"],"subs":[{"id":"1.1.1","n":"SIS identity feed","d":"Imports students, applicants and their enrollment affiliations from the student information system.","cls":"Core","src":["C","P","G"],"herm":"BC139"},{"id":"1.1.2","n":"HR identity feed","d":"Imports employees, positions and employment status from the HR system.","cls":"Core","src":["C"],"herm":"BC139"},{"id":"1.1.3","n":"ERP and sponsored-person feed","d":"Imports affiliates such as contractors and vendors recorded in the ERP or a sponsor system.","cls":"Expected","src":["C"],"herm":"BC139"},{"id":"1.1.4","n":"Manual guest and sponsored identity entry","d":"Lets an authorized sponsor create a guest or visitor identity with an end date.","cls":"Expected","src":["C","P","G"],"herm":"BC139"},{"id":"1.1.5","n":"Scheduled and event-driven source sync","d":"Pulls source changes on a schedule or on change events from the source system.","cls":"Core","src":["C"],"herm":"BC139"},{"id":"1.1.6","n":"Source attribute mapping","d":"Maps source fields to identity attributes with transforms and defaults.","cls":"Core","src":["C","P"],"herm":"BC143"},{"id":"1.1.7","n":"Source precedence rules","d":"Decides which source wins for each attribute when sources disagree.","cls":"Expected","src":["C","P","G"],"herm":"BC136"},{"id":"1.1.8","n":"Delta and full-load reconciliation","d":"Detects adds, changes and removals by comparing source loads to stored identities.","cls":"Expected","src":["C"],"herm":"BC143"},{"id":"1.1.9","n":"Authoritative source registration","d":"Registers SIS, HR, ERP, and other approved sources with explicit authority for selected attributes and affiliations.","cls":"Core","src":["P"],"herm":"BC139"},{"id":"1.1.10","n":"Source data validation and quarantine","d":"Isolates malformed or incomplete source records for review before they affect identities or access.","cls":"Expected","src":["P"],"herm":"BC143"}]},{"id":"1.2","n":"Match and correlate identities","herm":["BC139","BC143"],"subs":[{"id":"1.2.1","n":"Rule-based identity matching","d":"Matches incoming records to existing identities on configurable keys such as campus ID, birth date and name.","cls":"Core","src":["C","P","G"],"herm":"BC139"},{"id":"1.2.2","n":"Fuzzy and weighted matching","d":"Scores near matches on names, dates and contact data for likely duplicates.","cls":"Expected","src":["C"],"herm":"BC143"},{"id":"1.2.3","n":"Match review queue","d":"Routes uncertain matches to an operator to merge, link or create new.","cls":"Expected","src":["C","P"],"herm":"BC143"},{"id":"1.2.4","n":"Identity merge and unmerge","d":"Combines duplicate identities and reverses a mistaken merge with history kept.","cls":"Expected","src":["C"],"herm":"BC143"},{"id":"1.2.5","n":"Account correlation to identity","d":"Links existing application accounts to the right person identity.","cls":"Core","src":["C","P"],"herm":"BC139"},{"id":"1.2.6","n":"Orphan and uncorrelated account detection","d":"Lists accounts in target systems with no owning identity.","cls":"Expected","src":["C","P"],"herm":"BC139"}]},{"id":"1.3","n":"Assign identifiers and credentials of record","herm":["BC139"],"subs":[{"id":"1.3.1","n":"Unique identifier issuance","d":"Assigns a permanent, non-reused identifier to each person.","cls":"Core","src":["C","P"],"herm":"BC139"},{"id":"1.3.2","n":"Username and NetID generation","d":"Generates a login name from naming rules with collision handling.","cls":"Core","src":["C","P"],"herm":"BC139"},{"id":"1.3.3","n":"Email address assignment","d":"Generates a campus email address and alias from naming rules.","cls":"Expected","src":["C"],"herm":"BC139"},{"id":"1.3.4","n":"Identifier reservation and non-reuse","d":"Prevents released usernames and addresses from being reassigned to someone else.","cls":"Expected","src":["C"],"herm":"BC139"},{"id":"1.3.5","n":"Preferred and chosen name handling","d":"Uses a person's chosen name in display and directory attributes while keeping legal name restricted.","cls":"Expected","src":["C"],"herm":"BC139"}]}]},{"n":"2","name":"Affiliations and Lifecycle Events","desc":"Tracks each person's roles with the institution and the events that change their access.","area":"Identity Lifecycle","caps":[{"id":"2.1","n":"Maintain affiliations","herm":["BC139"],"subs":[{"id":"2.1.1","n":"Multiple concurrent affiliations","d":"Holds several affiliations per person, such as student employee and alumnus, at once.","cls":"Core","src":["C","P"],"herm":"BC139"},{"id":"2.1.2","n":"Primary affiliation calculation","d":"Derives a primary affiliation from rules for display and policy.","cls":"Expected","src":["C"],"herm":"BC139"},{"id":"2.1.3","n":"Affiliation effective dating","d":"Stores start and end dates for each affiliation, including future-dated changes.","cls":"Expected","src":["C","P"],"herm":"BC139"},{"id":"2.1.4","n":"Affiliation grace periods","d":"Keeps access for a set time after an affiliation ends, such as for graduating students.","cls":"Expected","src":["C","P"],"herm":"BC139"},{"id":"2.1.5","n":"Lifecycle state model","d":"Moves identities through states such as prospect, active, inactive, alumni and deceased.","cls":"Expected","src":["C"],"herm":"BC139"},{"id":"2.1.6","n":"Identity history","d":"Preserves changes to identifiers, affiliations, and lifecycle status for operational review.","cls":"Expected","src":["P"],"herm":"BC139"}]},{"id":"2.2","n":"Process joiner, mover and leaver events","herm":["BC139","BC136","BC220"],"subs":[{"id":"2.2.1","n":"Joiner event handling","d":"Triggers account creation and baseline access when a new affiliation appears.","cls":"Core","src":["C","P","G"],"herm":"BC139"},{"id":"2.2.2","n":"Mover event handling","d":"Recalculates access when department, position or program changes.","cls":"Expected","src":["C"],"herm":"BC139"},{"id":"2.2.3","n":"Leaver event handling","d":"Triggers disable and removal of access when the last qualifying affiliation ends.","cls":"Core","src":["C"],"herm":"BC139"},{"id":"2.2.4","n":"Rehire and re-enrollment handling","d":"Reactivates a returning person's existing identity instead of creating a new one.","cls":"Expected","src":["C","P"],"herm":"BC139"},{"id":"2.2.5","n":"Immediate termination","d":"Disables all access at once on an urgent separation request.","cls":"Expected","src":["C","P"],"herm":"BC139"},{"id":"2.2.6","n":"Deceased and FERPA-hold handling","d":"Applies special processing and attribute suppression for deceased persons or privacy holds.","cls":"Specialized","src":["C"],"herm":"BC136"},{"id":"2.2.7","n":"User lifecycle notifications","d":"Notifies users of activation, credential changes, factor changes, access decisions, and upcoming expiration.","cls":"Expected","src":["P"],"herm":"BC220"}]}]},{"n":"3","name":"Provisioning and Deprovisioning","desc":"Creates, updates, disables and removes accounts and entitlements in target systems.","area":"Identity Lifecycle","caps":[{"id":"3.1","n":"Provision accounts","herm":["BC139","BC204"],"subs":[{"id":"3.1.1","n":"Directory account provisioning","d":"Creates and updates accounts in campus directories such as Active Directory and LDAP.","cls":"Core","src":["C","P"],"herm":"BC139"},{"id":"3.1.2","n":"Cloud application provisioning","d":"Creates and updates accounts in cloud applications through SCIM or vendor APIs.","cls":"Core","src":["C","G"],"herm":"BC139"},{"id":"3.1.3","n":"Attribute-driven birthright access","d":"Grants baseline accounts and groups from affiliation and attribute rules.","cls":"Core","src":["C","P"],"herm":"BC139"},{"id":"3.1.4","n":"Just-in-time provisioning","d":"Creates an application account at first sign-in from assertion attributes.","cls":"Expected","src":["C","G"],"herm":"BC139"},{"id":"3.1.5","n":"Attribute push and update","d":"Sends attribute changes to connected systems when the identity changes.","cls":"Core","src":["C","P"],"herm":"BC139"},{"id":"3.1.6","n":"Provisioning approval hold","d":"Pauses selected provisioning actions until an approver confirms.","cls":"Expected","src":["C"],"herm":"BC139"},{"id":"3.1.7","n":"Manual provisioning task","d":"Creates a ticket or work item for systems with no connector.","cls":"Expected","src":["C","P"],"herm":"BC139"},{"id":"3.1.8","n":"Mailbox and collaboration provisioning","d":"Provisions email, calendar and file storage accounts tied to the identity.","cls":"Expected","src":["C"],"herm":"BC204"},{"id":"3.1.9","n":"Approved access assignment","d":"Provisions approved group memberships, application roles, and entitlements through target interfaces.","cls":"Core","src":["P"],"herm":"BC139"}]},{"id":"3.2","n":"Deprovision accounts","herm":["BC139","BC145","BC037"],"subs":[{"id":"3.2.1","n":"Account disable","d":"Disables accounts in connected systems when access should end.","cls":"Core","src":["C","P","G"],"herm":"BC139"},{"id":"3.2.2","n":"Staged deprovisioning","d":"Disables, then removes entitlements, then deletes accounts on a configured schedule.","cls":"Expected","src":["C","P"],"herm":"BC139"},{"id":"3.2.3","n":"Entitlement removal","d":"Removes groups and application rights that are no longer justified.","cls":"Core","src":["C","P"],"herm":"BC139"},{"id":"3.2.4","n":"Session and token revocation on leave","d":"Ends active sessions and revokes refresh tokens when access is removed.","cls":"Expected","src":["C"],"herm":"BC139"},{"id":"3.2.5","n":"Data retention handoff","d":"Notifies owners or transfers mailbox and file ownership before deletion.","cls":"Specialized","src":["C"],"herm":"BC145"},{"id":"3.2.6","n":"Alumni account conversion","d":"Converts a graduating student's account to a reduced alumni service set.","cls":"Specialized","src":["C"],"herm":"BC037"},{"id":"3.2.7","n":"Deprovisioning completion tracking","d":"Tracks target acknowledgments and escalates accounts or entitlements that remain active after withdrawal.","cls":"Expected","src":["P"],"herm":"BC139"}]},{"id":"3.3","n":"Control provisioning operations","herm":["BC139"],"subs":[{"id":"3.3.1","n":"Provisioning preview","d":"Shows what a rule change will grant or remove before it runs.","cls":"Expected","src":["C","P"],"herm":"BC139"},{"id":"3.3.2","n":"Provisioning retry and error queue","d":"Retries failed operations and lists errors for operator action.","cls":"Expected","src":["C","P"],"herm":"BC139"},{"id":"3.3.3","n":"Provisioning safety thresholds","d":"Stops a run when it would disable or delete more accounts than a set limit.","cls":"Expected","src":["C","P"],"herm":"BC139"},{"id":"3.3.4","n":"Target reconciliation","d":"Compares target accounts to expected state and reports or fixes drift.","cls":"Expected","src":["C","P"],"herm":"BC139"},{"id":"3.3.5","n":"Password and secret provisioning","d":"Sets initial passwords or activation links on new accounts.","cls":"Core","src":["C"],"herm":"BC139"},{"id":"3.3.6","n":"Provisioning dependency sequencing","d":"Orders provisioning steps when access assignments depend on prior account or directory creation.","cls":"Expected","src":["P"],"herm":"BC139"}]}]},{"n":"4","name":"Single Sign-On and Federation","desc":"Lets one sign-in reach many applications through standard protocols.","area":"Authentication","caps":[{"id":"4.1","n":"Federate applications","herm":["BC139"],"subs":[{"id":"4.1.1","n":"SAML 2.0 identity provider","d":"Issues SAML assertions to service providers.","cls":"Core","src":["C","P","G"],"herm":"BC139"},{"id":"4.1.2","n":"OpenID Connect and OAuth 2.0 provider","d":"Issues ID, access and refresh tokens to web, mobile and API clients.","cls":"Core","src":["C","P"],"herm":"BC139"},{"id":"4.1.3","n":"CAS and legacy protocol support","d":"Supports CAS, WS-Federation or header-based sign-in for older campus applications.","cls":"Specialized","src":["C","P"],"herm":"BC139"},{"id":"4.1.4","n":"Application catalog of preintegrated apps","d":"Provides ready configurations for common SaaS and education applications.","cls":"Expected","src":["C"],"herm":"BC139"},{"id":"4.1.5","n":"Attribute release policy","d":"Controls which attributes each application receives.","cls":"Core","src":["C","P"],"herm":"BC139"},{"id":"4.1.6","n":"Consent for attribute release","d":"Asks the person to approve attribute release where policy requires it.","cls":"Specialized","src":["C"],"herm":"BC139"},{"id":"4.1.7","n":"Single logout","d":"Ends sessions across participating applications on sign-out.","cls":"Expected","src":["C","P"],"herm":"BC139"},{"id":"4.1.8","n":"Attribute release minimization","d":"Restricts released identity attributes to the information approved for each consuming service.","cls":"Expected","src":["P"],"herm":"BC139"},{"id":"4.1.9","n":"Pairwise subject identifiers","d":"Issues service-specific subject identifiers to reduce unnecessary cross-service identity correlation.","cls":"Specialized","src":["P"],"herm":"BC139"}]},{"id":"4.2","n":"Participate in research and education federations","herm":["BC139"],"subs":[{"id":"4.2.1","n":"InCommon and eduGAIN metadata consumption","d":"Loads and refreshes federation metadata for partner service providers.","cls":"Specialized","src":["C","P"],"herm":"BC139"},{"id":"4.2.2","n":"Federation entity category support","d":"Releases attributes by categories such as Research and Scholarship.","cls":"Specialized","src":["C"],"herm":"BC139"},{"id":"4.2.3","n":"eduPerson and SCHAC attribute schema","d":"Expresses affiliations and identifiers using higher-education attribute standards.","cls":"Expected","src":["C"],"herm":"BC139"},{"id":"4.2.4","n":"External identity provider sign-in","d":"Accepts sign-in from social, partner institution or government identity providers.","cls":"Expected","src":["C","P","G"],"herm":"BC139"}]},{"id":"4.3","n":"Manage sessions","herm":["BC139"],"subs":[{"id":"4.3.1","n":"Central session lifetime policy","d":"Sets idle and absolute session timeouts by application or group.","cls":"Core","src":["C","P"],"herm":"BC139"},{"id":"4.3.2","n":"Session revocation","d":"Ends a person's sessions on demand.","cls":"Expected","src":["C","P"],"herm":"BC139"},{"id":"4.3.3","n":"Branded sign-in experience","d":"Applies campus branding, language and help links to sign-in pages.","cls":"Expected","src":["C"],"herm":"BC139"},{"id":"4.3.4","n":"Application launcher portal","d":"Shows each person a dashboard of the applications they can open.","cls":"Expected","src":["C","P"],"herm":"BC139"}]}]},{"n":"5","name":"Credentials and Multi-Factor Authentication","desc":"Owns passwords and second factors and verifies them at sign-in.","area":"Authentication","caps":[{"id":"5.1","n":"Manage passwords","herm":["BC139"],"subs":[{"id":"5.1.1","n":"Password policy","d":"Enforces length, complexity, history and expiration rules.","cls":"Core","src":["C","P"],"herm":"BC139"},{"id":"5.1.2","n":"Breached password screening","d":"Blocks passwords found in known breach lists.","cls":"Expected","src":["C"],"herm":"BC139"},{"id":"5.1.3","n":"Password synchronization","d":"Keeps the password consistent across directories and connected systems.","cls":"Expected","src":["C","P"],"herm":"BC139"},{"id":"5.1.4","n":"Account lockout and throttling","d":"Limits repeated failed sign-ins per account and source.","cls":"Core","src":["C","P"],"herm":"BC139"}]},{"id":"5.2","n":"Enroll and verify factors","herm":["BC139","BC197"],"subs":[{"id":"5.2.1","n":"Push notification factor","d":"Verifies sign-in through an approval prompt on a registered mobile app.","cls":"Core","src":["C","P","G"],"herm":"BC139"},{"id":"5.2.2","n":"Number matching and verified push","d":"Requires the person to enter a code shown at sign-in to defeat push fatigue.","cls":"Expected","src":["C","P"],"herm":"BC139"},{"id":"5.2.3","n":"One-time passcode factors","d":"Accepts TOTP app, hardware token, SMS or voice codes.","cls":"Core","src":["C"],"herm":"BC139"},{"id":"5.2.4","n":"FIDO2 security keys and platform authenticators","d":"Verifies sign-in with phishing-resistant WebAuthn credentials.","cls":"Expected","src":["C"],"herm":"BC139"},{"id":"5.2.5","n":"Factor enrollment workflow","d":"Guides a person through registering one or more factors.","cls":"Core","src":["C","P"],"herm":"BC139"},{"id":"5.2.6","n":"Factor policy by group and application","d":"Requires specific factor types for selected people or applications.","cls":"Expected","src":["C","P"],"herm":"BC139"},{"id":"5.2.7","n":"Temporary bypass codes","d":"Issues time-limited codes for a person who has lost a factor.","cls":"Expected","src":["C"],"herm":"BC139"},{"id":"5.2.8","n":"Hardware token inventory","d":"Tracks issued hardware tokens and their assignment.","cls":"Specialized","src":["C","P"],"herm":"BC197"},{"id":"5.2.9","n":"Factor revocation","d":"Invalidates lost, compromised, replaced, or no-longer-authorized authentication factors.","cls":"Expected","src":["P"],"herm":"BC139"}]},{"id":"5.3","n":"Strengthen account recovery","herm":["BC139","BC204"],"subs":[{"id":"5.3.1","n":"Identity proofing at enrollment","d":"Verifies a person's identity with documents or trusted data before issuing credentials.","cls":"Specialized","src":["C"],"herm":"BC139"},{"id":"5.3.2","n":"Recovery factor policy","d":"Restricts which factors may be used to reset a password or MFA.","cls":"Expected","src":["C","P"],"herm":"BC139"},{"id":"5.3.3","n":"Help desk identity verification","d":"Gives support staff a verified way to confirm a caller before resetting access.","cls":"Expected","src":["C","G"],"herm":"BC204"}]}]},{"n":"6","name":"Adaptive and Passwordless Authentication","desc":"Adjusts sign-in requirements to risk and removes reliance on passwords.","area":"Authentication","caps":[{"id":"6.1","n":"Evaluate sign-in risk","herm":["BC138","BC139"],"subs":[{"id":"6.1.1","n":"Contextual access policy","d":"Allows, challenges or blocks sign-in based on network, location, device and application.","cls":"Expected","src":["C","P"],"herm":"BC139"},{"id":"6.1.2","n":"Risk-based step-up authentication","d":"Requires an extra factor when a sign-in scores as risky.","cls":"Expected","src":["C","P","G"],"herm":"BC138"},{"id":"6.1.3","n":"Impossible travel and anomaly detection","d":"Flags sign-ins from improbable locations or unusual patterns.","cls":"Expected","src":["C","G"],"herm":"BC138"},{"id":"6.1.4","n":"Known bad IP and anonymizer blocking","d":"Blocks sign-ins from flagged networks, proxies and Tor exits.","cls":"Expected","src":["C"],"herm":"BC138"},{"id":"6.1.5","n":"Continuous access evaluation","d":"Re-evaluates live sessions and revokes them when risk or status changes.","cls":"Emerging","src":["C","P"],"herm":"BC138"},{"id":"6.1.6","n":"Identity threat signal sharing","d":"Exchanges risk events with other security tools through shared signals standards.","cls":"Emerging","src":["C"],"herm":"BC138"}]},{"id":"6.2","n":"Establish device trust","herm":["BC138","BC203"],"subs":[{"id":"6.2.1","n":"Device posture check","d":"Checks OS version, encryption and security software before granting access.","cls":"Expected","src":["C","P"],"herm":"BC138"},{"id":"6.2.2","n":"Managed device detection","d":"Distinguishes institution-managed devices from personal ones at sign-in.","cls":"Expected","src":["C"],"herm":"BC138"},{"id":"6.2.3","n":"Device registry","d":"Lists each person's registered devices and their trust state.","cls":"Expected","src":["C"],"herm":"BC138"},{"id":"6.2.4","n":"Endpoint management integration","d":"Reads compliance status from endpoint management tools.","cls":"Platform","src":["C"],"herm":"BC203"}]},{"id":"6.3","n":"Remove passwords","herm":["BC139"],"subs":[{"id":"6.3.1","n":"Passkey sign-in","d":"Lets people sign in with synced or device-bound passkeys instead of a password.","cls":"Emerging","src":["C","G"],"herm":"BC139"},{"id":"6.3.2","n":"Passwordless push or biometric sign-in","d":"Signs in with a verified push or device biometric alone.","cls":"Emerging","src":["C","P"],"herm":"BC139"},{"id":"6.3.3","n":"Certificate-based authentication","d":"Signs in with a smart card or device certificate.","cls":"Specialized","src":["C"],"herm":"BC139"},{"id":"6.3.4","n":"Phishing-resistant MFA enforcement","d":"Requires only phishing-resistant factors for selected groups.","cls":"Expected","src":["C","P"],"herm":"BC139"}]}]},{"n":"7","name":"Groups and Directory","desc":"Maintains the directory and the groups that carry access decisions to applications.","area":"Authorization and Access","caps":[{"id":"7.1","n":"Maintain directory","herm":["BC139","BC136","BC172"],"subs":[{"id":"7.1.1","n":"Central person directory","d":"Stores identity attributes for lookup by people and applications.","cls":"Core","src":["C","G"],"herm":"BC139"},{"id":"7.1.2","n":"Directory privacy controls","d":"Suppresses directory attributes for people with privacy flags.","cls":"Expected","src":["C"],"herm":"BC136"},{"id":"7.1.3","n":"LDAP directory service","d":"Exposes the directory to applications over LDAP.","cls":"Expected","src":["C"],"herm":"BC139"},{"id":"7.1.4","n":"Organizational hierarchy","d":"Represents departments, managers and reporting lines from source data.","cls":"Expected","src":["C"],"herm":"BC172"}]},{"id":"7.2","n":"Manage groups","herm":["BC139","BC021"],"subs":[{"id":"7.2.1","n":"Static groups","d":"Holds manually managed membership lists.","cls":"Core","src":["C","P"],"herm":"BC139"},{"id":"7.2.2","n":"Rule-based dynamic groups","d":"Computes membership from attribute rules such as course, department or affiliation.","cls":"Expected","src":["C","P"],"herm":"BC139"},{"id":"7.2.3","n":"Course and section groups","d":"Builds groups from enrollment data for course tools and collaboration.","cls":"Expected","src":["C"],"herm":"BC021"},{"id":"7.2.4","n":"Nested groups","d":"Allows groups to contain other groups with resolved effective membership.","cls":"Expected","src":["C"],"herm":"BC139"},{"id":"7.2.5","n":"Group ownership and self-managed groups","d":"Lets designated owners manage membership of their own groups.","cls":"Expected","src":["C","P"],"herm":"BC139"},{"id":"7.2.6","n":"Group expiration and renewal","d":"Expires groups or memberships unless an owner renews them.","cls":"Specialized","src":["C","P"],"herm":"BC139"},{"id":"7.2.7","n":"Group push to applications","d":"Sends group membership to directories and applications.","cls":"Core","src":["C"],"herm":"BC139"}]}]},{"n":"8","name":"Roles and Access Policy","desc":"Defines roles and policies that bundle entitlements and decide application access.","area":"Authorization and Access","caps":[{"id":"8.1","n":"Model roles","herm":["BC139","BC144"],"subs":[{"id":"8.1.1","n":"Business roles","d":"Bundles entitlements into roles tied to jobs or affiliations.","cls":"Expected","src":["C","P"],"herm":"BC139"},{"id":"8.1.2","n":"Entitlement catalog","d":"Lists each application's entitlements with descriptions and owners.","cls":"Expected","src":["C","P","G"],"herm":"BC139"},{"id":"8.1.3","n":"Role assignment rules","d":"Assigns roles automatically from identity attributes.","cls":"Expected","src":["C"],"herm":"BC139"},{"id":"8.1.4","n":"Role mining","d":"Suggests candidate roles by analyzing existing access patterns.","cls":"Specialized","src":["C","P","G"],"herm":"BC139"},{"id":"8.1.5","n":"Role lifecycle and versioning","d":"Tracks role changes, approvals and versions over time.","cls":"Specialized","src":["C"],"herm":"BC139"},{"id":"8.1.6","n":"AI-recommended access","d":"Recommends or flags access using peer-group and usage analytics.","cls":"Emerging","src":["C"],"herm":"BC144"},{"id":"8.1.7","n":"Assignment provenance","d":"Records whether access originated from eligibility, a request, a role, or an administrative exception.","cls":"Expected","src":["P"],"herm":"BC139"},{"id":"8.1.8","n":"Access outlier analysis","d":"Identifies unusual entitlement patterns for investigation against relevant peer populations.","cls":"Specialized","src":["P"],"herm":"BC144"}]},{"id":"8.2","n":"Enforce access policy","herm":["BC139","BC170"],"subs":[{"id":"8.2.1","n":"Application assignment by group or role","d":"Controls who may sign in to each application.","cls":"Core","src":["C","G"],"herm":"BC139"},{"id":"8.2.2","n":"Attribute-based access policy","d":"Allows or denies application access from identity and context attributes.","cls":"Expected","src":["C","G"],"herm":"BC139"},{"id":"8.2.3","n":"Fine-grained authorization service","d":"Answers application permission checks through an externalized policy engine.","cls":"Emerging","src":["C"],"herm":"BC139"},{"id":"8.2.4","n":"Separation-of-duties policies","d":"Defines conflicting entitlement combinations that one person should not hold.","cls":"Specialized","src":["C","G"],"herm":"BC170"},{"id":"8.2.5","n":"SoD violation detection and mitigation","d":"Detects SoD conflicts and records compensating controls.","cls":"Specialized","src":["C","P"],"herm":"BC170"}]}]},{"n":"9","name":"Privileged and Non-Human Access","desc":"Controls administrator, service and machine identities.","area":"Authorization and Access","caps":[{"id":"9.1","n":"Govern privileged access","herm":["BC139","BC203"],"subs":[{"id":"9.1.1","n":"Separate administrator accounts","d":"Issues distinct admin accounts linked to the owning person.","cls":"Expected","src":["C","G"],"herm":"BC139"},{"id":"9.1.2","n":"Just-in-time privileged elevation","d":"Grants admin roles for a limited time after approval.","cls":"Expected","src":["C","P"],"herm":"BC139"},{"id":"9.1.3","n":"Privileged role alerts","d":"Alerts on new or unusual privileged role assignments.","cls":"Expected","src":["C"],"herm":"BC139"},{"id":"9.1.4","n":"Privileged access management integration","d":"Connects to password vault and session recording tools.","cls":"Platform","src":["C"],"herm":"BC203"}]},{"id":"9.2","n":"Govern non-human identities","herm":["BC139","BC138","BC136"],"subs":[{"id":"9.2.1","n":"Service account inventory","d":"Lists service accounts with an accountable owner.","cls":"Expected","src":["C","G"],"herm":"BC139"},{"id":"9.2.2","n":"Application and API client registration","d":"Registers OAuth clients and workload identities with credentials and scopes.","cls":"Expected","src":["C"],"herm":"BC139"},{"id":"9.2.3","n":"Secret and certificate expiry tracking","d":"Warns before client secrets and signing certificates expire.","cls":"Expected","src":["C"],"herm":"BC138"},{"id":"9.2.4","n":"AI agent identity governance","d":"Registers, scopes and reviews identities used by automated agents.","cls":"Emerging","src":["C"],"herm":"BC136"}]}]},{"n":"10","name":"Access Requests","desc":"Lets people request access and routes approvals.","area":"Access Governance","caps":[{"id":"10.1","n":"Request access","herm":["BC139"],"subs":[{"id":"10.1.1","n":"Access request catalog","d":"Lets people browse and request applications, roles and groups.","cls":"Expected","src":["C","P","G"],"herm":"BC139"},{"id":"10.1.2","n":"Request on behalf of others","d":"Lets managers and sponsors request access for their people.","cls":"Expected","src":["C"],"herm":"BC139"},{"id":"10.1.3","n":"Request justification and end date","d":"Captures business reason and expiration with each request.","cls":"Expected","src":["C","P"],"herm":"BC139"},{"id":"10.1.4","n":"Request status tracking","d":"Shows requesters where their request is and who must act.","cls":"Expected","src":["C"],"herm":"BC139"}]},{"id":"10.2","n":"Approve access","herm":["BC139","BC170","BC204"],"subs":[{"id":"10.2.1","n":"Configurable approval workflow","d":"Routes requests to manager, owner and security approvers in sequence or parallel.","cls":"Expected","src":["C","P"],"herm":"BC139"},{"id":"10.2.2","n":"Approval delegation and escalation","d":"Reassigns or escalates approvals that are not acted on.","cls":"Expected","src":["C"],"herm":"BC139"},{"id":"10.2.3","n":"Policy check at request time","d":"Warns or blocks a request that would create a SoD conflict.","cls":"Specialized","src":["C","P"],"herm":"BC170"},{"id":"10.2.4","n":"Approval from chat and email","d":"Lets approvers act from email or collaboration tools.","cls":"Emerging","src":["C"],"herm":"BC139"},{"id":"10.2.5","n":"Ticketing system fulfillment","d":"Hands approved requests to a service desk tool for manual fulfillment.","cls":"Platform","src":["C"],"herm":"BC204"},{"id":"10.2.6","n":"Approval exception management","d":"Records approved departures from IAM access-assignment policy with owners, justification, and expiration.","cls":"Expected","src":["P"],"herm":"BC139"}]}]},{"n":"11","name":"Access Certification","desc":"Has owners and managers periodically confirm that access is still appropriate.","area":"Access Governance","caps":[{"id":"11.1","n":"Run certification campaigns","herm":["BC139"],"subs":[{"id":"11.1.1","n":"Manager access reviews","d":"Asks managers to confirm or revoke their people's access.","cls":"Expected","src":["C","G"],"herm":"BC139"},{"id":"11.1.2","n":"Application owner reviews","d":"Asks application owners to review everyone with access to their system.","cls":"Expected","src":["C"],"herm":"BC139"},{"id":"11.1.3","n":"Entitlement and role owner reviews","d":"Asks owners to review who holds a specific entitlement or role.","cls":"Specialized","src":["C"],"herm":"BC139"},{"id":"11.1.4","n":"Privileged access reviews","d":"Reviews administrator and service accounts on a shorter cycle.","cls":"Expected","src":["C"],"herm":"BC139"},{"id":"11.1.5","n":"Guest and sponsored access reviews","d":"Asks sponsors to renew or end guest access.","cls":"Expected","src":["C"],"herm":"BC139"},{"id":"11.1.6","n":"Campaign scheduling and scoping","d":"Schedules recurring campaigns and scopes them by application, group or population.","cls":"Expected","src":["C","P"],"herm":"BC139"},{"id":"11.1.7","n":"Event-triggered micro-certifications","d":"Starts a targeted review when a mover event or risk signal occurs.","cls":"Specialized","src":["C"],"herm":"BC139"},{"id":"11.1.8","n":"Reviewer assignment and delegation","d":"Assigns reviews to accountable managers or resource owners and records authorized delegation.","cls":"Expected","src":["P"],"herm":"BC139"}]},{"id":"11.2","n":"Support reviewer decisions","herm":["BC139","BC144","BC170"],"subs":[{"id":"11.2.1","n":"Reviewer decision context","d":"Shows last use, peer access and risk beside each item.","cls":"Expected","src":["C","P"],"herm":"BC139"},{"id":"11.2.2","n":"Bulk approve and revoke","d":"Lets reviewers act on many items at once with safeguards.","cls":"Expected","src":["C"],"herm":"BC139"},{"id":"11.2.3","n":"Automatic revocation of rejected access","d":"Removes access a reviewer revoked through provisioning.","cls":"Expected","src":["C","P"],"herm":"BC139"},{"id":"11.2.4","n":"Reviewer reminders and escalation","d":"Reminds reviewers and escalates overdue reviews.","cls":"Expected","src":["C","P"],"herm":"BC139"},{"id":"11.2.5","n":"AI-assisted review recommendations","d":"Suggests approve or revoke decisions based on usage and peer patterns.","cls":"Emerging","src":["C","P"],"herm":"BC144"},{"id":"11.2.6","n":"Certification evidence report","d":"Produces signed-off results for auditors.","cls":"Expected","src":["C","P"],"herm":"BC170"}]}]},{"n":"12","name":"Person Self-Service","desc":"Lets each person manage their own account and credentials.","area":"Self-Service","caps":[{"id":"12.1","n":"Activate and recover accounts","herm":["BC139"],"subs":[{"id":"12.1.1","n":"Account claiming and activation","d":"Lets a new person claim their account and set credentials after verification.","cls":"Core","src":["C","P"],"herm":"BC139"},{"id":"12.1.2","n":"Self-service password reset","d":"Lets a person reset a forgotten password after verifying identity.","cls":"Core","src":["C","P","G"],"herm":"BC139"},{"id":"12.1.3","n":"Self-service account unlock","d":"Lets a person unlock a locked account after verification.","cls":"Expected","src":["C"],"herm":"BC139"},{"id":"12.1.4","n":"Self-service MFA device management","d":"Lets a person add, replace or remove their factors.","cls":"Expected","src":["C","P"],"herm":"BC139"},{"id":"12.1.5","n":"Self-service password change","d":"Allows authenticated users to change their IAM-owned password under configured policy.","cls":"Expected","src":["P"],"herm":"BC139"}]},{"id":"12.2","n":"Manage profile and preferences","herm":["BC139"],"subs":[{"id":"12.2.1","n":"Profile view and update","d":"Shows a person their identity data and lets them edit permitted fields.","cls":"Expected","src":["C"],"herm":"BC139"},{"id":"12.2.2","n":"Recovery contact management","d":"Lets a person maintain recovery email and phone.","cls":"Expected","src":["C"],"herm":"BC139"},{"id":"12.2.3","n":"Directory privacy preference","d":"Lets a person control which directory attributes are visible where policy allows.","cls":"Expected","src":["C"],"herm":"BC139"},{"id":"12.2.4","n":"Sign-in activity view","d":"Shows a person their recent sign-ins and devices and lets them report activity.","cls":"Expected","src":["C"],"herm":"BC139"},{"id":"12.2.5","n":"Connected application consent review","d":"Lets a person see and revoke applications they granted access to.","cls":"Specialized","src":["C"],"herm":"BC139"},{"id":"12.2.6","n":"Personal access and expiration view","d":"Shows centrally tracked access assignments, ownership, and upcoming expiration to the affected user.","cls":"Expected","src":["P"],"herm":"BC139"}]}]},{"n":"13","name":"Delegated Administration","desc":"Gives help desks and departments scoped tools to support people.","area":"Self-Service","caps":[{"id":"13.1","n":"Support people","herm":["BC204","BC139"],"subs":[{"id":"13.1.1","n":"Help desk identity lookup","d":"Shows support staff a person's accounts, affiliations, factors and recent events.","cls":"Expected","src":["C"],"herm":"BC204"},{"id":"13.1.2","n":"Assisted password and MFA reset","d":"Lets support staff reset credentials after verification.","cls":"Expected","src":["C","P"],"herm":"BC204"},{"id":"13.1.3","n":"Scoped administrative roles","d":"Limits admin rights to a department, population or function.","cls":"Expected","src":["C","P","G"],"herm":"BC139"},{"id":"13.1.4","n":"Sponsor portal for guests","d":"Lets sponsors create, extend and end guest identities they own.","cls":"Expected","src":["C","P"],"herm":"BC139"},{"id":"13.1.5","n":"Departmental account administration","d":"Lets local IT manage groups and accounts for their own units.","cls":"Specialized","src":["C"],"herm":"BC139"}]}]},{"n":"14","name":"Logging and Audit","desc":"Captures and retains a complete trail of identity and access events.","area":"Logging, Audit and Reporting","caps":[{"id":"14.1","n":"Capture events","herm":["BC138","BC145"],"subs":[{"id":"14.1.1","n":"Authentication event log","d":"Records each sign-in, factor use, failure and session event.","cls":"Core","src":["C","P","G"],"herm":"BC138"},{"id":"14.1.2","n":"Administrative change log","d":"Records every configuration and admin action with actor and time.","cls":"Core","src":["C","P"],"herm":"BC138"},{"id":"14.1.3","n":"Provisioning and lifecycle log","d":"Records each account and entitlement change with the rule or request that caused it.","cls":"Core","src":["C","P"],"herm":"BC138"},{"id":"14.1.4","n":"Access request and review log","d":"Records requests, approvals and certification decisions.","cls":"Expected","src":["C"],"herm":"BC138"},{"id":"14.1.5","n":"Tamper-evident log retention","d":"Retains logs for a configurable period with protection from alteration.","cls":"Expected","src":["C","P"],"herm":"BC145"},{"id":"14.1.6","n":"Cross-system transaction correlation","d":"Associates source events, workflow decisions, and target operations through traceable transaction identifiers.","cls":"Platform","src":["P"],"herm":"BC138"}]},{"id":"14.2","n":"Investigate and prove","herm":["BC170","BC138","BC139","BC143"],"subs":[{"id":"14.2.1","n":"Event search and filtering","d":"Searches logs by person, application, time and outcome.","cls":"Expected","src":["C"],"herm":"BC138"},{"id":"14.2.2","n":"Who-has-access reporting","d":"Reports everyone with access to an application or entitlement and how they got it.","cls":"Expected","src":["C"],"herm":"BC139"},{"id":"14.2.3","n":"Access history for a person","d":"Shows what a person could access at a past date.","cls":"Specialized","src":["C","P","G"],"herm":"BC139"},{"id":"14.2.4","n":"Compliance report templates","d":"Provides reports aligned to audit needs such as terminated-user access.","cls":"Expected","src":["C"],"herm":"BC170"},{"id":"14.2.5","n":"Identity data quality reports","d":"Reports missing attributes, duplicates and unmatched accounts.","cls":"Expected","src":["C"],"herm":"BC143"}]}]},{"n":"15","name":"Identity Security Monitoring","desc":"Detects identity-based threats and posture weaknesses.","area":"Logging, Audit and Reporting","caps":[{"id":"15.1","n":"Detect threats","herm":["BC138"],"subs":[{"id":"15.1.1","n":"Compromised account detection","d":"Flags accounts showing credential stuffing, MFA fatigue or takeover signs.","cls":"Expected","src":["C"],"herm":"BC138"},{"id":"15.1.2","n":"Automated threat response","d":"Suspends, forces reset or revokes sessions when a threat is detected.","cls":"Expected","src":["C"],"herm":"BC138"},{"id":"15.1.3","n":"Identity posture assessment","d":"Reports weak configurations such as accounts without MFA or stale admins.","cls":"Expected","src":["C"],"herm":"BC138"},{"id":"15.1.4","n":"Dormant account detection","d":"Finds accounts with no recent use for cleanup.","cls":"Expected","src":["C"],"herm":"BC138"},{"id":"15.1.5","n":"Identity threat detection and response analytics","d":"Correlates identity events across systems to surface attacks.","cls":"Emerging","src":["C"],"herm":"BC138"}]}]},{"n":"16","name":"Integration","desc":"Connects the identity service to sources, targets and campus tools.","area":"Platform","caps":[{"id":"16.1","n":"Connect systems","herm":["BC203","BC139"],"subs":[{"id":"16.1.1","n":"Connector library","d":"Provides prebuilt connectors for directories, SIS, HR, ERP and SaaS applications.","cls":"Platform","src":["C"],"herm":"BC203"},{"id":"16.1.2","n":"SCIM 2.0 client and server","d":"Exchanges users and groups with SCIM-compliant systems.","cls":"Platform","src":["C","P"],"herm":"BC203"},{"id":"16.1.3","n":"Generic connectors","d":"Connects through flat files, JDBC, LDAP or REST when no prebuilt connector exists.","cls":"Platform","src":["C","P"],"herm":"BC203"},{"id":"16.1.4","n":"On-premises agent","d":"Connects cloud identity services to campus directories and databases behind the firewall.","cls":"Platform","src":["C","P"],"herm":"BC203"},{"id":"16.1.5","n":"Hybrid directory synchronization","d":"Synchronizes on-premises directories with the cloud directory.","cls":"Platform","src":["C"],"herm":"BC203"},{"id":"16.1.6","n":"RADIUS and VPN integration","d":"Adds MFA to VPN, wireless and network devices.","cls":"Platform","src":["C"],"herm":"BC139"},{"id":"16.1.7","n":"Remote desktop and server MFA","d":"Adds MFA to Windows, macOS and Linux sign-in and SSH.","cls":"Platform","src":["C"],"herm":"BC139"}]},{"id":"16.2","n":"Extend and automate","herm":["BC203","BC138","BC204"],"subs":[{"id":"16.2.1","n":"Management REST APIs","d":"Exposes identities, groups, policies and events through documented APIs.","cls":"Platform","src":["C","P"],"herm":"BC203"},{"id":"16.2.2","n":"Event hooks and webhooks","d":"Sends identity events to external systems as they happen.","cls":"Platform","src":["C","P"],"herm":"BC203"},{"id":"16.2.3","n":"Workflow automation designer","d":"Builds custom lifecycle and approval logic with low-code workflows.","cls":"Platform","src":["C"],"herm":"BC203"},{"id":"16.2.4","n":"Log streaming to SIEM","d":"Streams identity logs to security information and event management tools.","cls":"Platform","src":["C","P"],"herm":"BC138"},{"id":"16.2.5","n":"Service desk integration","d":"Creates and updates tickets in the campus service management tool.","cls":"Platform","src":["C"],"herm":"BC204"}]}]},{"n":"17","name":"Security and Configuration","desc":"Protects the identity service itself and manages its configuration.","area":"Platform","caps":[{"id":"17.1","n":"Secure the service","herm":["BC138","BC170","BC217"],"subs":[{"id":"17.1.1","n":"Administrator MFA and least privilege","d":"Requires strong authentication and scoped roles for the service's own admins.","cls":"Platform","src":["C","P"],"herm":"BC138"},{"id":"17.1.2","n":"Encryption in transit and at rest","d":"Encrypts identity data and secrets in transit and in storage.","cls":"Platform","src":["C","P"],"herm":"BC138"},{"id":"17.1.3","n":"Signing key and certificate management","d":"Manages and rotates token and assertion signing keys.","cls":"Platform","src":["C","P"],"herm":"BC138"},{"id":"17.1.4","n":"Data residency options","d":"Hosts identity data in a chosen region.","cls":"Platform","src":["C"],"herm":"BC170"},{"id":"17.1.5","n":"Security certifications","d":"Holds independent attestations such as SOC 2, ISO 27001 and FedRAMP where applicable.","cls":"Platform","src":["C"],"herm":"BC138"},{"id":"17.1.6","n":"Accessibility of end-user pages","d":"Meets WCAG accessibility requirements on sign-in and self-service pages.","cls":"Platform","src":["C","P"],"herm":"BC217"},{"id":"17.1.7","n":"Emergency administrative access","d":"Provides controlled and monitored recovery access when ordinary administrative authentication is unavailable.","cls":"Platform","src":["P"],"herm":"BC138"}]},{"id":"17.2","n":"Manage configuration","herm":["BC203"],"subs":[{"id":"17.2.1","n":"Separate test and production tenants","d":"Provides non-production environments for testing changes.","cls":"Platform","src":["C","P"],"herm":"BC203"},{"id":"17.2.2","n":"Configuration as code","d":"Exports and deploys configuration through versioned files or infrastructure-as-code tools.","cls":"Platform","src":["C","G"],"herm":"BC203"},{"id":"17.2.3","n":"Configuration change promotion","d":"Moves tested configuration from test to production with review.","cls":"Platform","src":["C","P"],"herm":"BC203"},{"id":"17.2.4","n":"Localization","d":"Presents end-user pages and messages in multiple languages.","cls":"Platform","src":["C"],"herm":"BC203"}]}]},{"n":"18","name":"Operations and Exit","desc":"Keeps the service available and lets a campus leave with its data.","area":"Platform","caps":[{"id":"18.1","n":"Operate the service","herm":["BC204","BC161"],"subs":[{"id":"18.1.1","n":"High availability and published SLA","d":"Runs with redundancy and a stated uptime commitment.","cls":"Platform","src":["C","P","G"],"herm":"BC204"},{"id":"18.1.2","n":"Outage fallback authentication","d":"Lets sign-in continue in a degraded mode when a dependency fails.","cls":"Platform","src":["C"],"herm":"BC161"},{"id":"18.1.3","n":"Health monitoring and alerts","d":"Reports connector, sync and service health to administrators.","cls":"Platform","src":["C","P"],"herm":"BC204"},{"id":"18.1.4","n":"Rate limits and capacity for peak periods","d":"Handles term-start and registration sign-in peaks without throttling.","cls":"Platform","src":["C","P"],"herm":"BC204"},{"id":"18.1.5","n":"Licensing by population","d":"Supports pricing and counting by student, employee and guest populations.","cls":"Platform","src":["C"],"herm":"BC204"},{"id":"18.1.6","n":"Operational ownership and documentation","d":"Records owners, dependencies, procedures, and support contacts for IAM integrations and policies.","cls":"Platform","src":["P"],"herm":"BC204"}]},{"id":"18.2","n":"Exit and portability","herm":["BC143","BC145","BC156"],"subs":[{"id":"18.2.1","n":"Full identity data export","d":"Exports identities, attributes, groups and assignments in standard formats.","cls":"Platform","src":["C","P","G"],"herm":"BC143"},{"id":"18.2.2","n":"Policy and configuration export","d":"Exports policies, rules and application configurations for migration.","cls":"Platform","src":["C","P"],"herm":"BC143"},{"id":"18.2.3","n":"Log export at exit","d":"Exports retained audit logs before contract end.","cls":"Platform","src":["C"],"herm":"BC145"},{"id":"18.2.4","n":"Factor and credential migration support","d":"Supports migrating enrolled factors or password hashes to another service.","cls":"Platform","src":["C","P"],"herm":"BC143"},{"id":"18.2.5","n":"Contractual data deletion","d":"Deletes institutional data on exit with certification.","cls":"Platform","src":["C","P"],"herm":"BC156"},{"id":"18.2.6","n":"Coexistence and cutover support","d":"Supports a controlled transition of source feeds, provisioning authority, and federation trust to a replacement service.","cls":"Platform","src":["P"],"herm":"BC143"}]}]}]}