Identity and Access Management

Employee identity, group membership, SSO into applications, and — in enterprises — provisioning and offboarding.

Directory and SSO are the authoritative source for who works at the company. The Forge trusts that record so joiner / leaver events don't have to be duplicated in every app.

• User identities and group memberships
• SSO session events
• Deactivation and role-change events

• Provisioning of Forge access when a new employee is created
• Role assignment aligned to a directory group
• Deprovisioning of Forge access when a directory user is deactivated

• Directory user created
• Directory user deactivated
• Group membership changed

• Manually creating Forge users when someone joins
• Forgetting to remove Forge access when someone leaves
• Maintaining per-app role mappings by hand

• Information technology or technical administrator
• Owner / executive
• Workforce, HR, or payroll administrator

• Access reviews scoped to the current directory state
• Orphaned accounts (users active in an app but inactive in the directory)

• Uses standards-based SSO (OIDC / SAML) where the provider supports it.
• Directory group → Forge role mapping is explicit and auditable.

• Small businesses may not have a directory — direct Forge accounts remain the primary path there.

The Forge is not a directory. It uses one when it exists.