Governance
Oleria AI Agent Gateway
AI agents are useful only when they can reach your SaaS applications - and today that usually means handing one a long-lived token. The AI Agent Gateway removes the credential from the agent entirely: it injects the credential per call, applies your permissions and your company’s policy before each action, and records everything. Risky operations can be allowed, alerted on, held for approval, or denied outright.See AI Agent Gateway for how it works.Integrations
Integration Studio is now generally available
Integration Studio has moved from preview to general availability - no longer off by default, and no need to reach out to enable it. Connect any app with a documented API without waiting on an engineering cycle: an AI research agent reads the API, drafts a connector manifest, and hands it to you to review and connect.See Integration Studio for how it works.Governance
Custom access requests
Not every access request runs through your governance program - an internal tool, an app you haven’t integrated, a one-off action nobody built a workflow for. Custom Access Requests close that gap: define the form, choose the webhook that provisions and revokes access, and it runs through the same approval and audit trail as everything else.See Custom Access for how it works.Governance
Approval chains
Not every access decision needs the same scrutiny. Approval Chains let you define the right review process for each request - one sign-off, or a chain through a manager, data owner, and security lead - with approvals that are manual, auto-approved by policy, or AI-assisted.See Approval chains for how it works.NHI
A 360-degree view of NHI governance
See lifecycle, credential, access footprint, and impersonation data for any non-human identity in one place, instead of piecing it together across separate systems. Privilege levels, scopes, and permissions are visible alongside it, so exposure and impact are clear at a glance.NHI
NHI credential expiry workflow
Catch NHI credentials before they expire, so the integrations and automations that depend on them don’t break. Owners are notified with enough runway to rotate the credential, and if nothing happens the alert escalates to a manager or admin - so an expiring credential never slips through unnoticed.API
The Oleria API is live for customers
The API Reference is live, covering the full identity and access graph instead of a single endpoint. It documents the core resource types (accounts, employees, departments, roles, non-human identities, and more) along with the relationships between them, plus the TrustFusion query engine and Downloads.- Non-human identities are a first-class resource - list and read them the same way as any other identity type, not as a separate bolt-on.
- Every object and relationship endpoint documents its scope requirements directly, so you can request access with the right permissions the first time.
- The OpenAPI spec backing this reference stays in sync with the platform automatically, so the docs won’t drift from what the API actually returns.
Integrations
BambooHR integration
BambooHR joined the application catalog, bringing employee and department data into the same governance as every other connected system.See the BambooHR integration for setup details.Integrations
Coupa integration
Coupa joined the application catalog, extending identity and access governance to procurement and spend management.See the Coupa integration for setup details.Integrations
Vanta integration
Vanta moved from generic SCIM coverage to its own dedicated integration, governed under the same workflows and policies as every other connected system.See the Vanta integration for setup details.Governance
Just-in-time access requests
Standing access is a standing risk. Access Requests grants access the moment it’s approved and automatically revokes it when the request expires, so access no longer lingers after the need is gone. Every request is fully audited.See Access Requests for how it works.Governance
Access bundle presets
Deciding how to group employees and what access each group needs is the hard part of an access bundle. Presets do it for you - ready-made bundles built from employee attributes like department, title, and manager, so you can roll out least-privilege access on day one without starting from a blank page.See Access Bundle Presets for how it works.Posture
Shadow IT detection workflow
Unsanctioned SaaS applications are now caught the moment they show up. IT owners get routed visibility - including an auto-created ticket - so unmanaged apps get a decision instead of quietly becoming part of the stack.See Application Hygiene and the Detect and report Shadow IT workflow for how it works.NHI
NHI ownership workflow
Every non-human identity now gets a clear, accountable human owner, established in a fraction of the time it used to take. Oleria suggests the most likely owner automatically, with human confirmation always required before it’s final.See NHI ownership assignment for how it works.Integrations
New integrations: GCP Secret Manager, DocuSign, and more
Several integrations shipped or expanded this quarter:- Google Cloud Platform integrations now discover Secret Manager secrets as non-human identities and analyze their access graphs, without ever reading secret values.
- DocuSign moved from generic SCIM coverage to its own dedicated integration, governed under the same workflows and policies as every other connected system.
- Atlassian Cloud and Slack now support governance actions (not just read-only visibility) where the connected app’s permissions allow it.
- GreytHR and Cursor joined the application catalog.
- SCIM 2.0 provisioning for Oleria workspace users themselves - connect your identity provider to provision workspace users, map groups to roles, and deprovision access automatically as your directory changes.
NHI
AI Gateway (preview)
AI agents are starting to take real actions across your environment, which means they need the same access controls people do. AI Gateway brokers what an agent can do at the moment it acts, enforcing least privilege for non-human identities in real time instead of trusting standing credentials. Available as a preview - off by default, reach out to enable it.Integrations
Integration Studio (preview)
Point an AI research agent at an app’s API documentation and it ships a governance-grade connector the same day, with you approving every step. These connectors write back, not just read, so you can remove access from day one, and a validator outside the AI checks every draft. Available as a preview - off by default, reach out to enable it.See Integration Studio for how it works.Governance
Access reviews on Active Directory groups
Nested AD groups hide who can actually reach what. Access reviews now run directly on your AD groups, the same way they already do for your IdP groups, with peer signals surfaced to guide each reviewer’s call.See Access Reviews for how it works.Governance
Access bundles with adaptive recommendations
New joiners are now provisioned automatically from your HR system. Instead of building an access list per hire, Oleria recommends a tailored bundle based on comparable peers, and the recommendation sharpens as roles shift - so joiners get least-privilege access from their first login, in minutes rather than weeks.See Access Bundles with adaptive recommendations for how it works.Integrations
Atlassian Cloud integration
Atlassian Cloud joined the application catalog, bringing accounts, groups, roles, and audit activity across your Atlassian organization under the same governance as every other connected system - beyond the generic SCIM coverage it had before.See the Atlassian Cloud integration for setup details.Integrations
Airtable integration
Airtable joined the application catalog, extending identity and access governance to bases, workspaces, and the accounts that can reach them.See the Airtable integration for setup details.API
Oleria MCP for external AI clients
The identity intelligence you already rely on now plugs directly into the AI clients your team uses every day - Claude, ChatGPT, Cursor, and any copilot built on the open MCP spec. It’s read-only, authenticates through your existing IdP, and inherits the full access graph underneath.See Oleria MCP for how to connect it.Integrations
Slack integration
Slack is one of the most active and most overlooked surfaces in an identity security program. Oleria’s Slack integration pairs access data with real usage signals, so over-privileged accounts, dormant users, and behavioral anomalies surface automatically without manual work.See the Slack integration for setup details.Posture
Shadow IT visibility in Governance
Application Hygiene gives visibility into shadow IT applications - the unsanctioned apps users access outside your approved software catalog. Your security team can see which applications are used without IT oversight, assess their risk, and act before they become a vulnerability. No additional configuration required.See Application Hygiene for how it works.NHI
NHI Posture Overview
An instant read on the health and risk exposure of every non-human identity in your environment, across service principals, AI agents, PATs, service accounts, and more - surfacing ownership gaps, dormancy, and high-privilege access. Pin and personalize your most-used views, with pre-built options for excessive privileges, broad scope, token credentials, dormant NHIs, AI agent inventory, and unowned identities.Posture
MFA authority and identity provider visibility
Access Inventory now shows the identity provider used to authenticate each account and the MFA authority enforcing MFA for it, across both SSO and local accounts. Access Inventory also now shows which individuals are designated as owners for each group, so accountability during access reviews is clear and no group is left without an owner.See Using Access Inventory for the full list of fields.API
Copilot is now conversational
Ask follow-up questions, refine your queries, and dig deeper - Copilot remembers the context of your conversation so you don’t have to repeat yourself. Powered by the new Oleria MCP, Copilot can answer questions across your entire environment: who has access to what, how they’re using it, and what risks to prioritize.See Oleria AI for sample prompts.Integrations
Generic SCIM integration, GCP, Nudge, and Microsoft Teams
- Generic SCIM integration unlocks identity visibility and governance for any application that supports the SCIM standard, no custom connector required - including Atlassian, Databricks, Intercom, Informatica, Datadog, Zscaler, and over 100 more.
- Google Cloud Platform is now supported, extending identity governance to GCP IAM roles and GCS bucket permissions.
- Nudge joined the application catalog.
- Microsoft Teams integration brings governance notifications - pending access reviews and identity lifecycle updates - directly into Teams.
Governance
Customizable columns and smarter integration search
- Every Access Inventory and Governance page now supports customizable columns - choose the fields that matter to your workflow, hide the rest, and arrange them to fit how your team reviews access data.
- The Integrations page now supports searching by application name and filtering by category (cloud platforms, custom applications, HR systems, identity providers, on-premises applications, and SaaS applications) across the Connected, Available, and Coming Soon tabs.
Governance
Access Bundles
Access Bundles introduced a way to group employees and grant access as a set, instead of assigning each application one at a time - the foundation the current bundle presets and adaptive recommendations build on.API
Downloads
The Downloads API introduced a way to export identity and access data programmatically - the foundation for what’s documented today as Downloads in the API Reference.See Working with Downloads for how it works.Integrations
Sage Intacct integration
Sage Intacct joined the application catalog, bringing financial management accounts and access under the same governance as every other connected system.See the Sage Intacct integration for setup details.Governance
Governance
Employee Lifecycle
Employee Lifecycle introduced automated joiner, mover, and leaver workflows driven directly from your HR system, replacing manual provisioning and deprovisioning checklists.Integrations
SAP Fieldglass integration
SAP Fieldglass joined the application catalog, extending identity and access governance to contingent workforce management.See the SAP Fieldglass integration for setup details.Governance
Access Reviews remediation actions
Access Reviews gained the ability to act directly on a reviewer’s decision - revoking flagged access as part of the review itself instead of leaving remediation as a separate manual step.See Access Reviews for how it works today.Governance
Roles in Access Inventory
Access Inventory added roles as a first-class object alongside accounts and groups, giving a clearer picture of who holds a role and what it grants.See Access Inventory for how it works today.Integrations
Ping Directory integration
Ping Directory joined the application catalog, extending identity and access governance to on-premises directory infrastructure.See the Ping Directory integration for setup details.Governance
Group Hygiene
Group Hygiene brought the same dormancy and utilization tracking Account Hygiene provides for individual accounts to groups - surfacing unused and dormant groups before they become an unmanaged access risk.See Group Hygiene for how it works.Governance
Account Hygiene becomes its own capability
Account Hygiene got its own dedicated experience for tracking dormant accounts and stale credentials, separate from the broader risk surface it grew out of.See Account Hygiene for how it works.Governance
Google Workspace remediation actions
Risk Monitoring gained the ability to fix a Google Workspace role assignment finding directly, instead of only flagging it for manual follow-up.See Remediations for how it works today.Integrations
SAP SuccessFactors integration
SAP SuccessFactors joined the application catalog, bringing HR accounts and org data into the same governance as every other connected system.See the SAP SuccessFactors integration for setup details.Integrations
Custom application integration
A generic connector made it possible to bring any application under governance, even without a pre-built integration - define the connection once and it’s treated like any other connected system.See Custom application for how it works.Integrations
Workday integration
Workday joined the application catalog, bringing HR accounts and org data into the same governance as every other connected system.See the Workday integration for setup details.API
Oleria’s AI assistant launches, as Copilot
What’s now Oleria AI launched as Copilot - a natural-language way to ask questions about identity and access instead of building a query by hand. The underlying assistant has grown considerably since, but this is where it started.See Oleria AI for what it can do today.Governance
Access Reviews
Access Reviews introduced recurring, campaign-based certification of who has access to what - the foundation the current Access Reviews experience builds on.See Access Reviews for how it works today.Integrations
Integrations
Active Directory integration
Active Directory joined the application catalog, extending identity and access governance to on-premises directory infrastructure.See the Active Directory integration for setup details.Integrations
Snowflake integration
Snowflake joined the application catalog, extending identity and access governance to your data warehouse.See the Snowflake integration for setup details.Governance
External Access - revoke access
External Access gained the ability to revoke a third party’s access directly, instead of only surfacing it for review.Integrations
PingOne integration
PingOne joined the application catalog, extending identity and access governance to another widely used identity provider.See the PingOne integration for setup details.Posture
Home page dashboard
A dedicated home page brought the key signals from across Oleria - risk, activity, and access - into a single dashboard, instead of requiring a tour through each capability separately.Posture
Entitlement Graph
Entitlement Graph filled a gap in Access Graph by showing the identity-to-application layer directly - which applications an identity can reach, how they got that access, and how often they use it.See Read the Access Graph for how it works today.Posture
GitHub support in Risk Monitoring
Risk Monitoring extended personal access token risk detection to GitHub, surfacing tokens that were overdue for rotation or broader than they needed to be.See Risk Monitoring for how it works today.Governance
Remediations
Remediations introduced one-click and automated corrective actions from Risk Monitoring, so a finding could be acted on directly instead of only being flagged.See Remediations for how it works today.Integrations
Okta integration
Okta joined the application catalog, bringing one of the most widely used identity providers under the same governance as every other connected system.See the Okta integration for setup details.Posture
Notification drawer and Group Utilization chart
A notification drawer brought system alerts into one place across the product, and Group Utilization gained a chart view for spotting usage trends across a group at a glance.Posture
Access Inventory
Access Inventory introduced a single, searchable view of identity accounts across connected applications - the foundation the current Access Inventory experience builds on.See Access Inventory for how it works today.Integrations
Microsoft integration
Microsoft 365 and Entra ID joined the application catalog, bringing one of the most widely used identity providers under the same governance as every other connected system.See the Microsoft Entra ID integration for setup details.Governance
Posture
Activity overlay on Access Graph
The activity overlay rendered account usage directly on Access Graph as edge thickness, making it possible to see at a glance which access is actively used and which has gone dormant.See Read the Access Graph for how it works today.Posture
Activity Analysis on real customer data, and navigation redesign
Activity Analysis moved from early sample data to live customer data, and the product navigation was redesigned around the capabilities customers actually use day to day.See Activity Analysis for how it works today.Integrations
Google Workspace integration
Google Workspace joined the application catalog, extending identity and access governance to one of the most widely used identity providers.See the Google Workspace integration for setup details.Posture
Risk Monitoring becomes its own capability
What started as Security and Access Hygiene was renamed Risk Monitoring, directly from customer feedback about what the feature actually does: track identity, access, and security risk in one place. The name has stuck ever since.See Risk Monitoring for how it works today.Integrations
Salesforce and ServiceNow integrations
Salesforce and ServiceNow joined the application catalog, among the first integrations to bring identity and access governance to a connected SaaS application.See the Salesforce and ServiceNow integrations for setup details.Posture
Activity Analysis
Activity Analysis introduced visibility into account activity across connected applications - the starting point for what’s grown into today’s activity dashboards and detail views.See Activity Analysis for how it works today.Posture
Hygiene score
A hygiene score gave a single number for the health of an application’s accounts and access - the earliest version of what account and group hygiene scoring looks like today.See Account Hygiene for how it works today.Posture