The identity fabric
One identity truth governs every principal — human and non-human. Five small services model an enterprise identity stack: a source-of-record (HRIS), governance (IGA), a change gate (ITSM), a CI/asset registry (CMDB), and a physical-access edge (PACS). Provisioning grants access slowly and under change control; a signaling bus broadcasts change in real time. Everything integrates over open standards, and every console is one login behind Duo.
The -lite apps
Each app mirrors its market leader's signature workflow over real (synthetic @lab.local)
data, Duo-gated at the Cloudflare Access edge.
| App | Role | Modeled on | Owns |
|---|---|---|---|
| HRIS-Lite | Source-of-record for humans | Workday HCM | Worker records · the RaaS feed IGA pulls |
| IGA-Lite | Governance & JML — reconcile, review, govern | SailPoint / Saviynt | The HRIS∪AD∪Entra∪Duo∪CII inventory · the plan |
| ITSM-Lite | Change-as-access gate + audit spine | ServiceNow ITSM | Every apply — nothing self-grants |
| CMDB-Lite | CI / asset-identity registry + device trust | ServiceNow / Device42 | The Service catalog · hardware-ID reconciliation |
| PACS-Lite | Physical-access edge (the door) | Verkada / Brivo | Badge grants · presence signal · RFIDeas Universal Enroll SDK badge enrollment |
Topology
Three domains
The fabric spans three names, each with a job:
grayskulltech.com
The apex / public edge — the Cloudflare zone and tunnels. Where identity meets the internet.
lab.grayskulltech.com
AD (lab.local), Duo, and the app realm. Where the fabric and its directory actually run.
identity.grayskulltech.com
This portal — the human front door to the consoles and the fabric's reference/training pages.