Gary Townsend · Customer Success Technical Leader · Duo Care Signature Support · Cisco

Identity Fabric

a hands-on identity-governance lab · Duo-gated at the edge · synthetic data only, no customer data

Learn the fabric

Read it front to back, or jump to a topic. Each page opens with what you'll learn and links to the next.

1 · The identity fabric →
what it is · the -lite apps · the 3 domains
Orientation: the source-of-record, governance, change gate, registry, and how they connect.
2 · Ownership & category model →
human · elevated · service · agent
The core mental model — HRIS governs humans; every non-human identity is owned by a human and tied to a service.
3 · Lifecycle & JML →
joiner · mover · leaver · onboarding
How a change flows: HRIS → IGA → ITSM gate → fulfillment, plus the leaver → orphan → reassign path.
4 · Standards-based integration →
SCIM · SSF / CAEP · RISC · PACS · egress / ingress
The two planes — provisioning (state) and signaling (events) — and how everything plugs in via open standards, plus the egress SWG and Cloudflare ingress boundary the fabric runs behind.
5 · Agentic AI gateways & access →
agentgateway · Envoy AI Gateway · Secure Access · Oort + Astrix
The third plane — how agents, models, and tools plug into the same identity truth across all three domains.

Present & reference

Executive walkthroughs and reference material — present the fabric end to end, see the production as-built, and map it to a real engagement.

Present · lab validation deck →
topology · workflow · network · ZTNA · scorecard
The Zero-Trust agentic-identity fabric end to end — what's proven vs pending, and what success looks like for the customer and the Care Signature team.
As-built · MCP gateway authZ →
17 AD groups · policy-as-code · tiered T0–T4
The production authorization plane: one AD-rooted group model governing all three gateways — agentgateway (MCP, live), Envoy (LLM), Secure Access (private apps).
Reference · Healthcare RACI →
Epic EMR acute facility · swimlane · RACI
Who owns identity across the provider lifecycle in an Epic acute-care hospital — the ownership map for a healthcare Duo engagement.

Operate — consoles

HRIS-Lite
HRIS source-of-record · Workday HCM-style
Worker directory, org chart, RaaS feed, and hot-edit (hire / terminate / move). Humans only.
hris-lite.grayskulltech.com →
IGA-Lite
Governance & JML · SailPoint / Saviynt-style
Identity inventory (HRIS∪AD∪Entra∪Duo∪CII), reconcile (JML), access review, govern → ITSM.
iga-lite.grayskulltech.com →
ITSM-Lite
Change-as-access gate · ServiceNow-style
Change queue, approval workspace, and a tamper-evident audit spine. Every apply is gated here.
itsm-lite.grayskulltech.com →
CMDB-Lite
CI / asset registry · ServiceNow / Device42-style
CI explorer, CI detail, and identifier lookup (MAC / serial / hostname → CI). Owns the Service catalog.
cmdb-lite.grayskulltech.com →
PACS-Lite
Physical-access edge · Verkada / Brivo-style
Badge grants tied to identity; a badge-in becomes a Zero-Trust presence signal. The door on the fabric.
pacs-lite.grayskulltech.com →
PAM-Lite
Privileged access · CyberArk / BeyondTrust-style
Just-in-time SG-* elevation and 1Password-brokered credential checkout — time-boxed, approved, auto-revoked. Break-glass with heightened audit. The privileged plane.
pam-lite.grayskulltech.com →