← Back
Home › Systems › Security and identity

iga

identity governance: provisioning connectors, access certification, role mining, separation of duties, request workflows

SailPoint, Saviynt, Entra ID Governance

SystemTechniques · 34Primitives · 97 iga Human-in-the-loop approvalagentic-ai · medium: Classify each proposed action as auto, ask or deny; park asks as durable pending records a human approves, edits or rejects, executing once, with timeouts that deny.›DAG workflow executiondistributed · medium: Run a graph of dependent tasks by releasing each one when its inputs are done, longest chain first, and skip any task whose input hashes are unchanged.›Desired-state reconciliationdistributed · medium: Declare the target in a store; controllers repeatedly diff actual against desired from full state and apply idempotent fixes, so missed events only delay convergence.›Deterministic simulation testingdistributed · medium: Run the whole system in one thread under a seeded scheduler with simulated network, disk and clock, so every failure replays from its seed.›Durable job queuedistributed · medium: Persisted tasks that workers lease for a visibility timeout, ack on success and retry with backoff; at-least-once execution that survives worker and queue crashes.›Durable workflow executiondistributed · medium: Ordinary code made crash-proof by logging every side-effect result and replaying the code from that log; activities run at least once, workflow logic must be deterministic.›Primary-backup replicationdistributed · medium: One node orders all writes and ships them to standbys; the acknowledgement rule (none, one, all) sets what a crash loses, and an external arbiter decides who takes over.›Dual control approvalsecurity · low: Four-eyes / maker-checker approval with quorum policies for sensitive operationsExponential backoff with jittersystems · low: Retry after delays that grow geometrically and are randomized, so failed clients spread out instead of hammering a recovering service in synchronized waves.›Idempotency keysfinance · low: Client-chosen unique key per logical operation, stored with a request fingerprint and the final response, so retries replay the first result instead of acting twice.›Authorization models (RBAC, ABAC, R…security · low: How to decide who may do what to which object; roles for coarse rules, relationships for sharing, and checks on every object.›Fuzzy string matchingsearch-sort · low: Edit distance, Jaro-Winkler and trigram indexes for approximate name and address matchingHdr histogramdata-structures · low: Log-linear bucketed histograms with bounded relative error for latency percentilesProcess supervisionhardware-os · low: A parent process starts services, reaps their exits and restarts them under a delay and burst-limit policy, then stops them with SIGTERM before SIGKILL.›k-means clusteringmachine-learning · low: Partition points into k clusters by alternating nearest-centroid assignment and centroid averaging; k-means++ seeding makes it dependable.›Ldap directorysecurity · low: LDAP directory model, bind, search filters and group membership queries for enterprise identityLeast privilege and isolationsecurity · low: Assume every component will be compromised and limit what it can then reach: narrow identities, separate accounts, sandboxed processes.›Mutual TLSsecurity · low: TLS where the client also proves a certificate key, so every connection carries a verified, rotatable machine identity.›OAuth 2 and OpenID Connectsecurity · low: Delegated authorization (OAuth 2) and login on top of it (OIDC); use authorization code + PKCE for every user-facing client.›Graceful drainingsystems · low: On a termination signal, stop taking new work, finish in-flight work until a deadline, tell clients to reconnect elsewhere, then exit; clients resume from a token.›Statechartsgraphics · low: State machines with nesting, parallel regions, history and entry/exit actions, so UI and animation logic stays linear in size instead of exploding.›Hierarchical timing wheelsystems · low: Timers bucketed by expiry into wheels of slots, coarser wheels for far deadlines: O(1) insert and cancel for millions of timeouts.›Topological sortgraphs · low: Order the vertices of a DAG so every edge points forward; the core of build systems, schedulers and dependency resolution, with cycle detection for free.›+ 27 more techniques+ 81 more primitives

Similar systems

Share the most building blocks with this one.

compliance-automation 40 %bpm-low-code 36 %uem 36 %agent-approvals 36 %cloud-governance 33 %