Everything about one person
Who they are, which company they work for, which sites they may enter and until when. On a single screen that replaces the spreadsheet, the mailbox and the 4 separate admin consoles.
Chapter one · Identities
1 record per person, above every system
Who the person is, why they are here, and when that reason ends, held on one record, above every access system you already run.
Identity Lifecycle
Identity lifecycle management for physical access
It is a loop. It goes round again every time someone joins, changes role or leaves. The identity record is created once, from the system that already knows about the person, and everything downstream is derived from it.
The loop
One identity record, first day to last
Someone joins, changes role or leaves, and the loop goes round again. Step 6 always leads back to step 1.
- 1
Onboard
From human resources, your directory or the contracting firm, once for every site
- 2
Qualify
Training, certificates and screening checked before access exists
- 3
Issue
Card, mobile or wallet, issued against the same record
- 4
Grant
Role, site and policy decide it, time-bound by default
- 5
Prove
Every change, approval and reason recorded as it happens
- 6
Revoke
Expiry, a lapsed certificate or a leaver closes it everywhere
What it does
In practice
Across every system at once
You see the rights that are live in each access system today, straight from the system itself.
Nothing typed twice
The record came from the source system. Nobody re-keyed it. Nobody can mistype it.
Anyone can request
A manager, a contractor coordinator or the person themselves. No ticket to the security team, and no phone call to the security desk.
The owner decides
The person responsible for that zone approves or refuses, and their reason is recorded with the decision. It stays with the record, not in somebody's inbox.
It ends on its own
Access is granted with an end date. Nobody has to remember to take it away.
The inbound story
Where the identity comes from
Your people data stays where it lives. We read it, we never own it.
- Who they are and which unit they are in
- First day and last day, carried as data
- The details that decide their access
- Open standard (SCIM 2.0) or file exchange
Your IT team connects us the same way they already connect any other business application. No development project, and no second copy of your people data. If IT can give an employee a software account automatically, they can give them a door the same way.
Questions
Frequently asked questions
What is Physical Identity and Access Management (PIAM)?
PIAM is the governance layer that sits above physical access control systems. Rather than administering doors and groups in each system, you hold one identity record per person. It carries the reason for access and the date it ends, and the access systems receive the resulting decisions.
Do we have to replace our access control systems?
No. Nothing is replaced. A governing layer is added above what you already run. Each access control system keeps doing what it does best, while the decision, the approval and the record move one layer up.
Where does the identity data come from?
From the system that already owns it: a human resources system, a directory, payroll or the contracting company. The connection uses SCIM 2.0 or file exchange. Setting it up is configuration work, and not a development project.
Do you store a copy of our workforce data?
We read people data at source and do not copy it into a second workforce database. We hold name and first name, unique identifiers, identity attributes, eligibility state, credential data, email address and mobile number, and nothing wider. That list is the answer your privacy reviewer is looking for.
The first step
Start with 1 site and 1 population.
You judge something that runs on your own site. Your access systems and readers stay where they are. If it earns its place, we extend it site by site.
One siteOne populationYour readers stay