Docs / Identity Governance

Control who can act, approve, and access.

Gvner governs identity changes, sessions, and access policies so execution authority is always traceable and auditable.

Identity topics

What identity governance covers

SSO providers

Register and validate SSO providers with explicit policy boundaries.

SCIM directory

Sync users and groups deterministically with audit visibility.

Role mapping

Map identity roles to governance capabilities and approval rules.

Session policy

Define session TTL, revocation rules, and delegated access.

Integration steps

1. Register SSO provider

Bind your identity provider and confirm verified domain ownership.

2. Enable SCIM sync

Sync users and groups into Gvner for deterministic authorization.

3. Map roles to capabilities

Define which roles can approve changes, override, or export evidence.

4. Set session policy

Configure TTL, revocation, and delegated session requirements.

Deep dives

Identity change control

Change queue

All identity changes are staged, reviewed, and approved before activation.

Explicit approvals
Recorded change diffs
Immutable timeline

Change receipts

Every approved change produces a receipt and evidence hash.

Receipt ID + hash
Registry snapshot reference
Exportable evidence packet

Operational workflow

Review identity ledger and admin sessions daily
Approve queued changes with dual control
Export receipts for auditors
Rotate session policies quarterly
Reconcile SCIM drift monthly
Archive evidence packs for regulators

Key API endpoints

POST /sso/providers — register SSO provider
POST /sso/session — issue governed SSO session
POST /scim/users — upsert user
POST /scim/groups — upsert group
GET /identity/ledger — identity ledger entries
POST /identity/changes/request — submit identity change
POST /identity/changes/approve — approve/apply identity change