IAM Data Onboarding for Compliance

Overview

A meaningful part of access-review evidence lives in IAM: who has access to what, when access was granted, and when it was removed. For a while, Automated Compliance could not use that data directly, so some customer workflows still fell back to exports and uploads.

The integration closed part of that gap for provisioning and access-review evidence. I partnered with the IAM team to bring their ledger and report data into Automated Compliance, so those workflows could flow through report-backed monitors instead of a separate manual path.

What I built

The ownership boundary was explicit: IAM owned the identity data, and I owned the Automated Compliance integration. My side was identifying the reportable datasets we needed, scoping report access to eligible customers, and fixing report joins so IAM rows surfaced. I also migrated beta monitors onto the new fields.

After that migration work, IAM-backed provisioning monitors could use the same report-template pattern as other automated evidence paths. IAM-backed provisioning and access-review monitors did not need bespoke logic for every evidence question. They needed a clear data contract and report templates that represented app access history correctly.

The key design question was where to draw the boundary. IAM owns the record of access, Automated Compliance owns the compliance interpretation, and the contract stays thin: reportable identity and access records cross the boundary while control logic and evidence presentation stay on our side.

Collaboration

I partnered with the IAM team on source records, report fields, customer access gating, and the boundary between identity ownership and compliance interpretation.

Outcome

• Provisioning and access-review reports can run against IAM-backed data.
• Provisioning and access-review evidence moved into report-backed monitors for workflows that had relied on exports or incomplete paths.
• The integration clarified a reusable shape for cross-team report data: thin source-data contracts, explicit access gating, and compliance logic on the Automated Compliance side.

The reusable pattern was an interface with clear ownership. IAM kept owning the source records, Automated Compliance owned the compliance interpretation, and the report contract stayed thin enough to avoid blurring either team's ownership boundary.