Enterprise IAM reference architecture.
How I'd design identity for a large, regulated organisation — the layers, the control points, and how they fit together. Vendor-neutral: this is the shape of the system, not a product list. Every box maps to a capability you can assess and a control you can evidence.
01 Authoritative sources
Identity starts with truth, not tickets. HR systems drive the employee lifecycle; a contractor/partner register governs everyone else; a device & asset inventory supplies the posture signals that later decisions depend on. Every identity has a source, an owner and an expiry — no exceptions for "temporary" access.
02 Identity Governance (IGA)
The system of record for who should have what. Joiner-mover-leaver automation provisions from the authoritative source; RBAC keeps grants role-derived; risk-based certifications and continuous separation-of-duties checks keep entitlements honest. This is where access is decided and proven.
03 Identity Provider & Directory — the Policy Decision Point
Where every access request is judged. Strong, phishing-resistant authentication, SSO, and conditional access that weighs identity, device posture and context per request — the Zero-Trust PDP. The directory is a crown-jewel asset and is protected like one.
04 Privileged Access (PAM)
Administrative power, contained. Credentials vaulted, sessions brokered and recorded, and standing privilege driven toward zero with just-in-time elevation. The goal isn't a bigger vault — it's that, at any moment, almost no privilege is standing and exposed.
05 Non-human & AI identity
The fastest-growing and least-governed population. Service accounts, API tokens, workload identities and AI agents each get an owner, least-privilege scope, and rotation — governed with the same rigour as humans, because they are more numerous, more privileged and less watched.
06 Protected resources & enforcement
SaaS, cloud, on-prem and data each sit behind a Policy Enforcement Point that applies the PDP's decision. Least privilege at the door decides how much damage a compromised session can do — so enforcement and entitlement are designed together, not bolted on.
07 Identity Visibility & ITDR — across everything
Every layer emits telemetry to a centralised, queryable, tamper-resistant store. Behavioural baselining detects the login-not-break-in attacks; rehearsed response levers — disable, revoke sessions and tokens, reset, quarantine — contain them in minutes. Detection and response are a property of the whole fabric, not a bolt-on.
Design principles
Authoritative sourcing
Lifecycle is driven by systems of truth, never by memory or tickets. Reconciliation proves intended access matches reality.
Least privilege by default
Birthright is minimal; everything else is requested, time-bound and reviewed. Standing privilege trends toward zero.
Per-request, context-aware decisions
Trust is evaluated continuously on identity, device and context — the network is never a proxy for trust.
Evidence as a first-class output
Every control produces audit evidence by design, mapped to the frameworks the organisation is measured against.
Govern machines like humans
Non-human identities carry owners, scope and lifecycle — the next breach class, designed for now.
Detection & response built in
Identity is the most-attacked surface; visibility and fast response levers are part of the architecture, not an afterthought.
Trust zones
Segmentation expressed as escalating trust requirements — movement between zones is brokered and inspected, never implicit.
Key flows
Provisioning
Source event → IGA evaluates role & policy → directory and downstream apps provisioned with least-privilege, role-derived access.
Authentication
Request → PDP weighs identity, device & context → PEP enforces at the resource → re-evaluated continuously; trust revocable mid-session.
Privileged elevation
Request → approval → time-boxed JIT grant → brokered, recorded session → automatic expiry, fully audited.
De-provisioning
Leaver event → disable everywhere within hours → revoke sessions & tokens → reconcile target systems to prove nothing remains.
Anti-patterns this design eliminates
Help desk as source of truth
Identity events driven by tickets and memory instead of authoritative systems — the root of orphaned access.
Standing & shared privilege
Permanent admin rights and shared credentials — the 24/7 attack surface attackers prize most.
Network as trust
"Inside the firewall" treated as trusted — the assumption nearly every modern breach exploits.
Ungoverned machine identity
Service accounts, tokens and agents with no owner, no scope and no rotation.
Scattered, short-lived logs
Identity telemetry spread across systems with retention too short to investigate an incident.
MFA gaps & silent exceptions
Coverage holes and undocumented exemptions — where one missing control becomes a breach.
Adoption roadmap
A pragmatic sequence — risk-reduction first, optimisation later. Most organisations sit mid-Phase 2.
Get the truth and the doors right
Authoritative-source-driven joiner-mover-leaver automation, MFA on every internet-facing door, privileged credentials vaulted, and identity logs centralised. Closes the gaps behind most incidents.
Make access provable
RBAC with risk-based certifications and separation-of-duties, brokered and recorded privileged sessions, conditional access, and a non-human identity inventory with owners.
Toward Zero Trust
Just-in-time / near-zero standing privilege, phishing-resistant MFA everywhere, per-request context-aware access, ITDR with posture management, and governed AI & agent identity.
Free to adopt and adapt as a starting blueprint for client engagements, internal programs or RFP responses — please retain attribution to Aditi Shah · helloaditi.au. Vendor-neutral by design; map the capabilities to your chosen platforms. Provided as-is, without warranty.
Want to know where your own program sits against this? Run the IAM Maturity Index or work through the Identity Security Baseline — and get in touch to design it for real.