Former employees retaining system access for days or weeks after offboarding because deprovisioning depends on IT receiving a manual notification and working through a checklist?
Access reviews that exist on paper but have no enforcement mechanism -- managers rubber-stamp the list, nothing gets revoked, and the auditor asks why access hasn't changed in 18 months?
Identity and Access Management Software
User provisioning done manually by IT when a ticket arrives. Access reviews sent out by email quarterly, with half the managers not responding and no enforcement of the overdue revocations. Privileged admin accounts shared between engineers because individual provisioning is too slow. The access control architecture is documented. The operational reality is different.
We build custom IAM platforms: automated provisioning and deprovisioning triggered by your HR system, access review workflows that route to the right managers and enforce revocations, privileged access management with audit trails, and the access record that compliance auditors can actually verify. Built to integrate with your identity provider and the applications your workforce accesses.
User provisioning and deprovisioning automation -- triggered by HR system events, not IT tickets
Role-based access control management -- roles defined, maintained, and enforced systematically
Access review and certification workflows -- routed to managers, tracked, and enforced
Privileged access management -- admin accounts with session recording and just-in-time access
RaftLabs builds custom identity and access management software -- user provisioning and deprovisioning automation, role-based access control management, access review and certification workflows, privileged access and admin account management, SSO and identity provider integration with Okta, Azure AD, and Google Workspace, and the access audit trail that compliance auditors require. We build IAM platforms designed around your specific application landscape and workforce structure, not a generic IGA product that covers the average enterprise. Most IAM software projects deliver in 10-16 weeks at a fixed cost.
100+Products shipped
·24+Industries served
·FixedCost delivery
·10-16Week delivery cycles
Access control documented in policy and managed in spreadsheets are two different things
Most organisations have an access control policy. Fewer have a system that enforces it. User provisioning is triggered by a ticket or an email, not an automated process. Roles are defined in a document that is six months out of date. Access reviews go out via email, get inconsistently completed, and overdue revocations sit unactioned. The audit trail is a collection of IT tickets and email threads that doesn't answer the question auditors actually ask: who had access to what, when, and was it reviewed?
Custom IAM software closes the gap between policy and practice. Provisioning and deprovisioning that runs automatically when your HR system records a change. Access reviews that route to the right reviewers, track completion, and enforce revocations with or without a response. Roles managed in a system that reflects current application access, not a document that reflects what was agreed twelve months ago. The audit trail that demonstrates access is actively governed, not assumed.
What we build
User provisioning and deprovisioning automation
Provisioning workflows triggered by HR system events: new hire, role change, department transfer, or termination. Integration with your HRIS -- Workday, BambooHR, HiBob, or custom HR systems -- to receive lifecycle events and translate them into access actions. Application provisioning via identity provider (Okta, Azure AD, Google Workspace) SCIM or direct API integration with applications that don't support SCIM. Deprovisioning on termination that runs within minutes of the HR record update, not days after an IT ticket. Grace period management for contractors and temporary access. The joiner-mover-leaver process that operates without manual intervention for standard role changes.
Role-based access control management
Role definition and management in a system that reflects actual application access rather than a permissions document. Role catalogue with the applications, permissions, and data categories each role carries. Role assignment to users based on job function and department, with approval workflows for non-standard access requests. Separation of duties rules that flag or block conflicting role combinations. Role mining from your current access state to identify what roles actually exist in your environment versus what is documented. Role lifecycle management: new roles proposed, reviewed, approved, and retired in a governed workflow. The foundation that makes access reviews meaningful rather than a confirmation of whatever access users happened to accumulate.
Access review and certification workflows
Access certification campaigns configured by review scope: all users with access to a specific system, all users in a department, all privileged accounts, or a full user population review. Review tasks routed to application owners and line managers with the context they need to make a certification decision -- what the user has access to, when it was granted, and when it was last reviewed. Reminder escalation for overdue reviewers. Automatic revocation of access not certified by the review deadline. Exception management for access that is being challenged. Campaign reporting showing completion rate, revocation count, and outstanding items. The certification process that produces a defensible record for auditors rather than a spreadsheet of email replies.
Privileged access and admin account management
Privileged account inventory: all admin accounts, service accounts, and shared credentials catalogued and owned. Just-in-time access for privileged sessions -- access granted for a defined time window for a specific task, then automatically revoked. Session recording for privileged access to production systems: full session capture for forensic review and compliance evidence. Privileged access request workflow with approval by a second authorised party before access is granted. Admin account password rotation automation to eliminate long-lived static credentials. Break-glass emergency access with immediate alerting and mandatory post-use review. The privileged access controls that reduce the blast radius of credential compromise.
SSO and identity provider integration
Integration with your identity provider -- Okta, Microsoft Azure AD, Google Workspace, Ping Identity -- as the authoritative source for user identities and authentication. SAML 2.0 and OIDC integration for SSO to applications that support federation. SCIM provisioning for automated account lifecycle management in applications that support the protocol. Legacy application integration via LDAP or reverse proxy for systems that don't support modern federation protocols. MFA policy enforcement through your identity provider, surfaced in the IAM platform's access configuration. The integration layer that makes your identity provider the single source of truth for access across your application landscape.
Access audit trail and compliance reporting
Immutable audit log of every access event: account created, role assigned, access granted, access reviewed, access revoked, privileged session initiated. Who did it, when, under what authority, and what the outcome was. Access history reports for individual users showing the full lifecycle of their access across all applications. Reports formatted for SOC 2, ISO 27001, and HIPAA access control evidence requirements. Exception reports flagging access granted outside standard role definitions, reviews completed past deadline, and accounts not reviewed within required intervals. The evidence library that turns a compliance audit from a weeks-long evidence collection exercise into a reporting exercise.
Frequently asked questions
Identity and Access Management (IAM) is the broad category covering how users are identified and what they can access. Identity Governance and Administration (IGA) is the governance layer within IAM: role management, access request workflows, access certification campaigns, and the audit trail that demonstrates access is actively managed. Privileged Access Management (PAM) is the specific discipline of managing high-privilege accounts -- admins, service accounts, break-glass credentials -- with controls like just-in-time access, session recording, and password vaulting. Custom IAM software can span all three disciplines or focus on the specific gap your organisation has. We scope the requirement during discovery rather than assuming you need a full IGA platform when an access review workflow would solve the immediate problem.
Joiner-mover-leaver automation requires integration between your HRIS and your identity provider. When a new employee joins, the HRIS record triggers provisioning of the identity provider account and application access based on their role and department. When an employee changes roles, the mover event triggers removal of previous role access and provisioning of the new role -- without waiting for a ticket. When an employee leaves, the leaver event triggers immediate deprovisioning: identity provider account disabled, active sessions terminated, application access removed, and privileged accounts revoked. We design the lifecycle events, the access mapping from HR attributes to access roles, and the exception handling (e.g., access retained during notice periods) during the scoping phase before development begins.
We integrate with identity providers via their management APIs and SCIM endpoints. Okta integration uses the Okta Management API for user and group lifecycle management, and supports SCIM 2.0 for application provisioning. Azure AD integration uses the Microsoft Graph API for user, group, and application assignment management. Google Workspace integration uses the Admin SDK and Google Directory API. The IAM platform we build uses your identity provider as the authoritative identity source -- we read user and access state from it, and write provisioning and deprovisioning actions back to it. We don't replace your identity provider; we add the governance and workflow layer that your identity provider doesn't provide natively.
A focused IAM tool -- provisioning and deprovisioning automation with access review workflows for a defined set of applications -- typically runs $20,000 to $60,000. A full IGA platform covering role management, access certification across your application landscape, privileged access management, and comprehensive audit reporting runs $60,000 to $150,000 depending on the number of applications, identity provider complexity, and compliance reporting requirements. We scope the project before pricing it. You get a fixed cost before development starts.
Security Compliance Software -- automated evidence collection, continuous control monitoring, and audit-ready platforms
Talk to us about your IAM project.
Tell us your identity provider, the applications you need to govern, and where the current process is breaking down. We'll design the platform and give you a fixed cost.
