🧭 Reconciliation
Real IGA doesn't stop at provisioning — it continuously checks whether the authoritative directory and actual access still agree. This scan diffs your own SCIM directory against active memberships in organizations you own, matched by email, live, every time you run it. Nothing is snapshotted: fix the underlying data and a finding simply disappears on the next scan.
Two of the three drift classes are remediable — clicking Remediate performs a real removal of the underlying org membership, re-verified against the LIVE diff first (a finding that's already resolved itself refuses the action rather than deleting something stale). The third is visibility-only: there's no grant to remove.
X-ray
🩻 X-ray — what actually happened
Your own insert-only audit trail — the real server events, sanitized (never a secret), each linked to the lesson that explains it.