Identity governance,
without the rip-and-replace.
Orendyr sits on top of Microsoft 365, Okta, and the rest of your SaaS — adding the workflow, policy, and evidence layer auditors ask for. No parallel directory. No shadow access state. If we're removed, your platforms stay coherent.
- SOC 2 Type II · ISO 27001
- 99.99% rolling availability
- Open verifier on GitHub
- Frontier-model agentic workflows
Orendyr adds a layer. It never becomes the layer.
Legacy IGA tools try to become the directory.
We refuse.
The reason SailPoint, Saviynt, and One Identity projects stall for 18 months is the same reason they cost seven figures: they want to be the new source of truth. That's a migration, not a product. Orendyr ships as an overlay — a clean seam between your platforms and the governance layer on top of them.
You don't pick a tier. You map each resource to one of three behaviors.
Observed, Hybrid, and Managed aren't plans you buy. They're what Orendyr does on any single resource — a group, an app, a HRIS feed, a privileged role. Most customers run all three at once and promote resources over time.
observedRead, never write. Orendyr sees it, governs it in reports, touches nothing.
hybridNative rule stays intact. Orendyr governs only the attributes the rule keys on.
managedOrendyr owns the join condition end-to-end. Every mutation writes via native APIs.
The six jobs that eat your IT team's week.
If your identity program runs on a mix of spreadsheets, Jira tickets, and brave people clicking fast, you already have the use-cases. Orendyr takes them off the humans — without handing the directory to a vendor.
HRIS-triggered onboarding. Role changes reconcile in minutes, not quarters. Leavers soft-suspend in 24h, then revoke — every step a signed step.
Auto-assemble reviews from the warehouse. Managers approve in one click with risk-weighted context. Evidence packs ship straight to your auditor.
NetSuite AP Approver paired with Coupa Vendor Setup. Entra privileged role paired with anyone who signed a policy exception. Detection is continuous.
Elevate for 60 minutes, with a reason string on the audit record. Auto-revoke on timeout. Scheduled break-glass drills prove the drill actually works.
Weekly sweep finds disabled users still holding privileged roles, groups without owners, and grants nobody's touched in 90 days. Orendyr drafts the revoke — you approve.
Someone added an admin in the portal? We notice. Orendyr diffs observed state against intended state and surfaces every delta in the posture dashboard.
State machines. Not YAML nightmares.
Six block kinds. Every block documents the native APIs it touches and the audit events it emits. Every run is replayable with a correlation id. Drag on a canvas, version in git, approve in a review.
- TriggerHRIS event, schedule, policy violation, access request.
- DecisionYes/no branch over identity attributes, risk, or time.
- ActionNative mutation — grant, revoke, request approval.
- NotifyTeams, Slack, email, webhook. Quiet hours honored.
- WaitPause for approval or duration with escalation.
- OutcomeSuccess or denied, with evidence attached.
orendyr.workflow.step with a step id and correlation token. Replay any run from the audit log.Evidence an auditor can verify without us.
Every action appends to a per-tenant SHA-256 hash chain. A daily Merkle batch anchors to WORM storage (S3 Object Lock or Azure Immutable Blob) and, optionally, to Bitcoin via OpenTimestamps. The verifier is open source. No blockchain hype, no vendor lock-in on your evidence.
Every event carries the hash of the previous event. A single mutation anywhere in the chain invalidates every hash that follows.
event_n.hash = sha256(event_n-1.hash || event_n.body)S3 Object Lock or Azure Immutable Blob. Retention periods are tenant-configurable. The anchor isn't ours — it's yours.
A free, globally-verifiable Bitcoin timestamp. No wallet. No gas. Just a proof you can re-check on any laptop in 2035.
github.com/orendyr/verify re-checks the chain with just the signed JSON bundle and the anchor proof. Hand your auditor a USB stick. We don't need to exist.
orendyr-verify ./bundle.jsonAn AI that stays in its lane.
Frontier-model reasoning, grounded in your identity warehouse. The Warden investigates across platforms, drafts workflows from a sentence, explains policy denials in plain English, and chains tools safely — with three effect tiers enforced at the schema level and a human gate on anything that writes.
readRuns against the warehouse. Answers posture questions without ever reaching a native API.
proposeDrafts workflows, reviews, and evidence packs to the canvas. You're the one who ships them.
executeCan call native APIs — but always pauses for a human on a confirmation gate first.
Frontier-model assistance, where it matters.
Ask an afternoon's worth of IGA work in a sentence. The Warden runs multi-step reasoning over your warehouse, your policies, and your audit history — and hands back a verifiable answer, not a summary.
- Investigates posture across every connected platform in one query
- Drafts workflows from plain language — rendered to the canvas, never auto-published
- Explains policy denials in plain English with the exact rule that fired
- Reconstructs failed runs: which step, which API, which permission was missing
- Assembles evidence packs an auditor will accept
warden.correlation id.We win where it matters. Here's the matrix.
Built from the public product docs and marketing material of each vendor. If you think a cell is wrong, email us — we'll update it. SailPoint and Saviynt are strong at enterprise audit; they're weak at getting out of their own way. Okta IGA is getting better; it's still bounded by the Okta directory. That's the real gap.
| Capability | Orendyrus | SailPoint | Saviynt | Okta IGA |
|---|---|---|---|---|
| Sits on top of M365 / Okta as systems of record | ||||
| Removable without a migration project | ||||
| Three-tier ownership (Observed / Hybrid / Managed) | ||||
| Native workflow state-machine canvas | ||||
| Tamper-evident audit chain (SHA-256) | ||||
| External anchor (WORM + OpenTimestamps) | ||||
| Open-source verifier | ||||
| Works on a single M365 tenant with no IGA team | ||||
| Frontier-model agent grounded in your data with a human gate | ||||
| AI with read / propose / execute tiers + human gate | ||||
| Typical time-to-first-workflow | Day 1 | 6-12 months | 4-9 months | 4-8 weeks |
| Typical first-year TCO (mid-market) | $ | $$$$ | $$$$ | $$ |
Identity governance.
On the platforms you already own.
Start Observed. Keep your directory. Hand an auditor a USB stick. Cancel any time and your platforms stay coherent — because we were never the directory.