Services - What we build and how it ships
Good identity infrastructure is invisible. Access works when it should, is revoked when it should be, and auditors can see the evidence. When identity systems are underdeveloped, the symptoms show up elsewhere: manual IT tickets, access reviews done in spreadsheets, off-boarding steps that someone has to remember. This work is about getting to the invisible state.
Full service catalog
These come up often enough that we scope them as standalone engagements. They can also be bundled into a larger project.
SAML/OIDC Integration Sprint
Get your applications on SSO. We scope in batches of 5 to 10 apps, configure SAML or OIDC, set up SCIM provisioning, and test against your actual user population.
SSH Certificate Enforcement
Replace static SSH keys with short-lived certificates issued through your identity provider. No more key sprawl. When someone is offboarded, their SSH access ends with it.
Privileged Access Management (PAM)
Admin accounts are the ones that matter most and get reviewed least. We build controls for privileged access: service account vaulting, just-in-time admin access, break-glass procedures, session monitoring.
Agentic Identity Architecture
AI agents and automation bots are proliferating faster than most teams can track them. We design lifecycle and governance for non-human identities: how they get credentials, what access they get, how that access is scoped, and what happens when the agent is retired.
Retained Advisory
For teams that have shipped the implementation and want someone to call when something comes up. Architecture reviews, troubleshooting, vendor evaluations. Monthly retainer, minimum three months.
Application Integration
The per-app work of wiring SSO and provisioning: SAML/OIDC configuration, SCIM setup, attribute mapping, and testing. Scoped per-application or in bundles.
Bulk Operations Tooling
When you need to change attributes, migrate groups, or reassign applications across thousands of records and cannot afford to get it wrong. Dry-run validation and rollback included.
Why we publish prices
The numbers on our service pages are what engagements actually cost — not "starting at" prices that triple after the scoping call. If we are outside your budget, better to know that now than after a 45-minute discovery meeting.