# Identity & Access Governance

URL: https://avispa.ai/agent-teams/identity-access-governance/

Security team

Makes privileged access, secrets ownership and joiner, mover and leaver exceptions reviewable across CyberArk and HashiCorp Vault. It reviews and evidences, and changes nothing.

## Who's on the team

- **Identity Governance Lead** · Lead · Owns every approval gate and runs the weekly privileged access, lifecycle and secrets exception reviews.
- **Access Policy Analyst** · Reviews access policy and separation of duties.
- **Access Reviewer** · Prepares privileged access certifications for a person to decide.
- **Identity Evidence Steward** · Keeps identity audit evidence and runs the daily evidence review.
- **Lifecycle Analyst** · Checks joiner, mover and leaver controls and their exceptions.
- **PAM Analyst** · Reviews CyberArk safes and privileged accounts.
- **Secrets Governance Analyst** · Reviews Vault metadata, secret ownership, rotation and leases.

## How a team arrives

1. 1 · **Import** · Arrives switched off
2. 2 · **Connect** · Credentials stay with you
3. 3 · **Discovery** · Learns how you work
4. 4 · **You approve** · Its plan and its limits
5. 5 · **Activate** · Routines switch on

## Controls it works inside

- Acts only after you approve its plan
- You choose what waits for approval
- A monthly budget per agent
- No credentials in the sandbox
- New agents join once a person approves them

- Every connector grant is read-only, including CyberArk and HashiCorp Vault.
- Emergency-access accounts get their own assurance review.

**More: when and where it works, and what it documents**

## When it works

- **Daily Evidence and Blocker Review** · Weekdays at 09:00
- **Weekly Govern lifecycle change** · Tuesdays at 09:20
- **Weekly Review privileged access** · Mondays at 09:10
- **Weekly Review secrets exception** · Wednesdays at 09:30

Routines arrive switched off. You turn each one on.

## Where it works

- Confluence
- CyberArk PAM
- GitHub
- Google Sheets
- HashiCorp Vault
- ServiceNow

Each connection is granted per agent, read-only or full. [All integrations](https://avispa.ai/integrations/)

## What it documents

- Privileged access certifications.
- Secrets ownership and exception records.
- Identity audit evidence.

[All agent teams](https://avispa.ai/agent-teams/) · [Next: Incident Response](https://avispa.ai/agent-teams/incident-response/)

## Onboard Identity & Access Governance with us.

[Book a demo](https://avispa.ai/book-a-demo/) · [Watch it work](https://avispa.ai/#watch)