When their job changes, so does their access.
Let your HRIS decide who gets what.
The Problem
Traditionally, employee access is given through a request to IT. An employee needs access to something, so someone in IT gives it to them. As this cycle repeats, a person accumulates access from every job they've had and no one knows what they actually need.
But your HRIS already knows what a person needs because it's determined by their department, job, location, and whether they still work here.
2% of the permissions granted to identities were actually used, and more than half of those identities could reach every resource.
HRIS-Derived Access Control
In Klef, access is set by policy. Policies describe what level of access a group of workers should have and what happens when they lose it. This specificity keeps organizations from granting people more access than they actually need.
policy "Engineering access" { category = "Engineering" applies = segment.engineering stage active { target microsoft_entra.user { userPrincipalName = worker.business_email displayName = worker.display_name jobTitle = worker.job.name accountEnabled = true groups = ["All Employees", "Engineering"] licenses = [lookup(table.skus, worker.job.code)] } target github.member { login = lookup(table.github_usernames, worker.business_email) member = true role = "member" teams = ["engineering"] } target slack.user { userName = worker.business_email displayName = worker.display_name title = worker.job.name channels = ["engineering", "incidents", "deploys"] } } stage terminated { target microsoft_entra.user { accountEnabled = false groups = [] licenses = [] } target github.member { member = false teams = [] } target slack.user { active = false channels = [] } }}