Access management overview
Give people the access they need, exactly when they need it — and take it back automatically when they don't. No standing privileges, no manual deprovisioning, no forgotten access after a project ends.
Atomicwork's Identity Governance & Administration (IGA) turns access from a manual, ticket-driven chore into an autonomous, governed workflow. You define your applications, their entitlements, and the policies that govern them once — and Atom takes over from there: interpreting requests, checking eligibility, running approvals, provisioning access, and revoking it the moment its window closes.
A few principles shape how it works. Access is time-bound by default — permanent access has to be configured deliberately, so the secure path is the default path. Expired grants are revoked automatically by an hourly agent run, so nothing lingers after it's needed. Employees request in plain language through Atom rather than filing forms. And every grant, automated or manual, is logged for compliance with a full provision-to-revoke timeline.
This page is the overview. Step-by-step setup lives in Setting up agentic access provisioning, and time-bound access is covered in Just-in-Time access management.
How it works
Define applications & entitlements
Add the tools your organization uses (Salesforce, HubSpot, Cursor…) and describe the specific levels of access — View accounts, Edit opportunities, Read-only — that each one offers. If you've connected an IdP like Okta or Entra, your apps populate automatically.
Set access policies
Map user segments to the entitlements they should get, and decide whether access is pre-approved or requires review. One app can carry many policies — Sales gets Standard User, Finance gets Marketplace Viewer, Marketing gets Read-only.
Employees request through Atom
Someone asks "Can I get access to Salesforce Marketplace?" Atom finds the matching policy, confirms eligibility, and routes any required approval — all in the conversation.
The agent provisions access
On approval, the IGA agent grants the entitlement via the configured method — adding the user to an Okta or Entra group, or opening a service request for manual fulfilment.
Access expires on its own
For time-bound grants, the agent records an expiry timestamp and deprovisions automatically when the window closes. The employee gets a heads-up first, with a one-click option to request an extension.
Built for both sides of the desk
For employees, access becomes conversational. They can request access to any app through Atom, ask what they're eligible for or already have, and get access instantly when policy allows or follow a clean approval path when it doesn't. Before a grant is revoked they receive an expiry reminder they can extend in one click, and they can even ask by category — "design apps", "sales tools", "infra apps".
For admins, the work moves from fulfilling tickets to setting policy. You define applications, entitlements, and policies centrally; automate provisioning through Okta or Entra (or fall back to service requests); and set approval policies that notify the right stakeholders. Atomicwork also recommends policies generated from your existing access patterns, and every grant and change is visible through the Access Grants dashboard and audit logs.
Just-in-Time access
Granting permanent access to every application an employee touches is a security risk your team shouldn't have to carry. Just-in-Time (JIT) access lets you set exactly how long a user can hold an entitlement — and revokes it automatically when that window closes. Turning on Allow access extension requests from expiry notifications lets users buy more time without filing a fresh request; the extension flows through the same policy you already defined.
The minimum JIT duration is 6 hours, the industry standard. New policies default to time-bound access — permanent access must be turned on deliberately.
Common questions
What happens when a grant expires? The IGA agent deprovisions the entitlement automatically on its hourly run, records the deprovision timestamp, and closes out the grant. Users are notified before revocation, so nothing disappears without warning.
Can I revoke access before the JIT window closes? Yes — from Settings → Access Management → Access Grants, open any grant and revoke it manually at any time. Useful when someone changes roles or leaves a project early.
How do I track who has access to what? The Access Grants dashboard lists every active and inactive grant, filterable by application, user, entitlement, status, or expiry date. Each grant opens a full timeline of when access was provisioned and deprovisioned.
What if a user qualifies for more than one policy? Set a conflict rule per application under Settings: apply the highest-severity policy, the most recently created one, or the one targeting the most specific segment.