User Identity
An authenticated user record — credentials, roles, last access, and risk indicators.
Why This Object Matters for AI
AI identity threat detection analyzes user behavior; access management depends on identity data.
Security & Compliance Capacity Profile
Typical CMC levels for security & compliance in SaaS/Technology organizations.
CMC Dimension Scenarios
What each CMC level looks like specifically for User Identity. Baseline level is highlighted.
User identity management is entirely informal. New employees get accounts created by whoever handles IT that day, with whatever access seems right. There is no user identity register, no documented role definitions, and no record of who has access to what. 'Who has admin access to production?' gets answered with 'probably the engineering leads, let me check.'
None — AI has no user identity records to reason about because nothing is documented.
Create a user identity register documenting each user's account, role assignment, application access, and the date access was granted.
A spreadsheet lists user identities and their application access, but it drifts from reality within weeks. Role definitions are informal — 'developer' might mean read-only in staging for one person and full admin in production for another. Terminated employees appear as active. New hires granted access last month are missing entirely.
Can list documented user identity records but cannot verify whether the spreadsheet reflects actual access state or identify accounts that should have been deprovisioned.
Implement an identity provider (IdP) with structured user identity profiles containing role assignments, group memberships, application entitlements, and provisioning timestamps.
An identity provider manages user identity profiles with SSO, role assignments, and group memberships. But entitlements are granted on request without consistent documentation of business justification. Risk indicators like failed login attempts and privilege escalation patterns are not tracked as part of the user identity record.
Can query the IdP for current role assignments and group memberships but cannot assess whether access levels are appropriate without business justification records or behavioral risk signals.
Enforce documented business justification for every access grant and add behavioral risk indicators — failed login counts, last access timestamps, privilege escalation history — to each user identity profile.
Every user identity profile contains structured role assignments, application entitlements with business justification, access request audit trails, last-access timestamps, failed login history, and behavioral risk scores. A security analyst can query 'show me all users with production access who haven't logged in for 90 days and their original access justification' and get a documented, verifiable answer.
Can perform access reviews, detect dormant accounts, flag excessive entitlements, and assess behavioral risk indicators for anomaly detection.
Implement a validated user identity schema with enforced attribute types, privilege escalation audit trails, credential lifecycle tracking, and automated consistency checks across all integrated applications.
A validated user identity schema enforces attribute types, links every entitlement to an approved request with business justification, maintains credential lifecycle records (creation, rotation, expiration), and validates consistency across all connected SaaS applications. AI agents evaluate user identity risk programmatically using structured behavioral baselines.
Can detect access anomalies, enforce least-privilege by comparing entitlements to usage patterns, automate access certification workflows, and predict credential compromise risk from behavioral signals.
Deploy continuous identity governance that auto-adjusts access based on role changes, behavioral analytics, real-time risk scoring, and peer group comparison across all SaaS applications.
Continuous identity governance auto-adjusts user identity access based on role changes, behavioral analytics, and real-time risk scoring. Entitlements are granted and revoked dynamically as job functions evolve. Peer group comparison flags anomalous access patterns before they become security incidents. The user identity record is self-documenting and always current.
Can autonomously manage the user identity lifecycle — provisioning, adjusting, and deprovisioning access in real time based on behavioral, organizational, and risk signals across all SaaS applications.
Ceiling of the CMC framework for this dimension.
Capabilities That Depend on User Identity
Other Objects in Security & Compliance
Related business objects in the same function area.
Security Vulnerability
EntityA discovered security weakness — CVE, severity, affected systems, and remediation status.
Security Event
EntityA logged security occurrence — type, source, target, and risk level that enables threat detection.
Access Policy
RuleA permission configuration — roles, resources, conditions, and enforcement that controls access.
Compliance Control
EntityA required security measure — framework, control ID, implementation status, and evidence.
What Can Your Organization Deploy?
Enter your context profile or request an assessment to see which capabilities your infrastructure supports.