Grayskull Technology · Lab Identity Governance Fabric

Identity Fabric

identity.grayskulltech.com · CastleOps lab · Duo-gated at the edge

Operate — consoles

HRIS-Lite
HRIS source-of-record · Workday HCM-style
Worker directory, org chart, RaaS feed, and hot-edit (hire / terminate / move). Humans only.
hris-lite.grayskulltech.com →
IGA-Lite
Governance & JML · SailPoint / Saviynt-style
Identity inventory (HRIS∪AD∪Entra∪Duo∪CII), reconcile (JML), access review, govern → ITSM.
iga-lite.grayskulltech.com →
ITSM-Lite
Change-as-access gate · ServiceNow-style
Change queue, approval workspace, and a tamper-evident audit spine. Every apply is gated here.
itsm-lite.grayskulltech.com →
CMDB-Lite
CI / asset registry · ServiceNow / Device42-style
CI explorer, CI detail, and identifier lookup (MAC / serial / hostname → CI). Owns the Service catalog.
cmdb-lite.grayskulltech.com →
PACS-Lite
Physical-access edge · Verkada / Brivo-style
Badge grants tied to identity; a badge-in becomes a Zero-Trust presence signal. The door on the fabric.
pacs-lite.grayskulltech.com →

Learn the fabric

Read it front to back, or jump to a topic. Each page opens with what you'll learn and links to the next.

1 · The identity fabric →
what it is · the -lite apps · the 3 domains
Orientation: the source-of-record, governance, change gate, registry, and how they connect.
2 · Ownership & category model →
human · elevated · service · agent
The core mental model — HRIS governs humans; every non-human identity is owned by a human and tied to a service.
3 · Lifecycle & JML →
joiner · mover · leaver · onboarding
How a change flows: HRIS → IGA → ITSM gate → fulfillment, plus the leaver → orphan → reassign path.
4 · Standards-based integration →
SCIM · SSF / CAEP · RISC · PACS
The two planes — provisioning (state) and signaling (events) — and how everything plugs in via open standards.
5 · Agentic AI gateways & access →
agentgateway · Envoy AI Gateway · Secure Access · Oort + Astrix
The third plane — how agents, models, and tools plug into the same identity truth across all three domains.
As-built · MCP gateway authZ →
17 AD groups · policy-as-code · tiered T0–T4
The production authorization plane: one AD-rooted group model governing all three gateways — agentgateway (MCP, live), Envoy (LLM), Secure Access (private apps).