Hiring an identity governance implementation partner should buy you working joiner-mover-leaver paths, recertification evidence, and an admin story that does not depend on a standing break-glass user. It should not buy you a slide deck about a platform you will configure later. Rutagon is the builder: we wire HRIS to IdP to custom apps, we write the evidence your GRC tool can attach, and we remove standing admin from the operating path. This article is what a mid-market SaaS buyer (50–500 people) should demand in the SOW.
If a partner cannot name the terminate event, the revoke list, and the sample packet, they are selling workshops. If they need a permanent org-admin user in your IdP to “operate the program,” they are the privileged leftover.
Demand outcomes you can sample. Then hire the team that builds them.
What an Identity Governance Implementation Partner Must Ship
An identity governance implementation partner must ship three operating loops. Joiners get the right bundles from an HR event, not from a Slack guess. Movers get a scoped recert and a same-week revoke of the prior role, not a stacked group list. Leavers get IdP, SaaS, and leftover tokens in one event. We already describe that spine as joiner-mover-leaver automation. Demand it as a deliverable, not as a future phase.
Evidence is the second loop. Reviews run, decisions persist, mutates complete or stay open. A campaign that is “done” with failed write-backs is not done. Demand the packet: population, decisions, exceptions with expiry. Automated access reviews are the shape. The partner should not leave you exporting CSV forever.
The third loop is privileged access. No standing admin as the daily driver. Admin is assumed, time-boxed, or dual-controlled. The partner’s own implementation users expire. If they ask for a permanent privileged service account in your cloud, that account is in scope for the same rules.
Questions That Separate a Builder From a Workshop
Ask how a custom app without SCIM enters the review. If the answer is “out of scope,” your auditors will still sample that app. Ask who owns a failed SaaS revoke. If the answer is “your intern,” the automation is theater. Ask where the evidence file lives and how it goes stale. If the answer is a slide, there is no store.
Ask whether the partner will be in your AWS account with a user key. The acceptable answer is a role you own, with an external ID or federation, and a removal date. IAM’s introduction to roles is the model. A partner who requires a long-lived key to implement identity work has already failed the credential bar.
Ask what happens when you already have a GRC platform. The builder attaches to it. The workshop replaces it in conversation. We attach.
What Rutagon Builds in the Engagement
We inventory HR events, IdP groups, SaaS tenants, and internal apps. We implement the connectors and the jobs. We stand up the review packets and the leaver/mover clocks. We put privileged access on assumed roles. We do not rename your existing GRC tenant. We fill the gap it cannot see.
Security automation is the capability page for that work. The diagnostic is how we find the first revoke list and the first evidence hole before a long SOW.
demand:
jml: hr-event to revoke
review: decisions plus mutate
admin: no standing daily admin
refuse:
workshop-only
permanent partner admin user
evidence as screenshots only
We will not write you a competitor bake-off. We will tell you what will be running in your environment when we leave.
How to Read the SOW
The SOW should list systems, events, and artifacts. “Stand up identity governance” is not a list. “Terminate event X revokes tenants A/B/C and writes packet D” is a list. Acceptance is a sample: pick a leaver, pick a mover, pick a privileged assume, show the packet.
Payment tied only to workshops is a warning. Payment tied to running jobs and a closed exception list is the shape we use.
If you need a partner who implements, not a partner who facilitates your spreadsheet, that is the hire.
Acceptance tests a buyer can run before the last invoice
Demand tests you can execute, not adjectives. Pick a hire from last month and show the joiner grants match the bundle. Pick a transfer and show the old role died inside the week. Pick a termination and show SaaS leftover tokens gone. Pick a privileged assume and show it was not a standing user. If those four paths fail, the implementation is not accepted. Rutagon builds toward those tests. A partner who declines to put them in the SOW is selling time.
Demand a system list with owners. “All SaaS” is not a list. Named tenants with admin API or a documented human step are a list. Custom apps with an export path are a list. The first SOW does not need every long-tail tool. It needs the ones your auditors already sample, plus the ones that can still mint production access. Expanding the list is a later change order, not an infinite implied scope.
Demand that the partner’s access to your environment expires. Implementation roles, CI identities, and break-glass they used for cutover get a removal date. We use assumed roles in AWS, not a standing user we keep “for support.” If you want a retainer, that is a new, scoped identity, not the build identity left on.
Demand evidence routing into the GRC platform you already run. A second portal the partner owns is a hostage file. Exports you can attach are fine. A black box you cannot leave is not.
Demand a written leftover list at the end: systems not wired, pairs not computed, PATs not eliminated. Honesty about residue is part of the deliverable. A green close that hides residue becomes your finding next cycle.
We will run a diagnostic before a long build so you see the first revoke list and the first evidence hole. That is the security automation conversation, not a platform bake-off. Book the call if you want the map and the tests named in the SOW.
Frequently Asked Questions
Should we hire an FTE instead of an implementation partner?
Hire an FTE when you have a year of backlog and a manager for that person. Hire a builder when you need the loops running this quarter and the FTE would spend the first months discovering connectors. Many teams do the surge, then keep a smaller internal owner. The partner should leave runbooks, not a mystery box.
What if we already bought an IGA product?
Then demand that the partner implement your joiner-mover-leaver and evidence on that product plus the custom connectors it does not have. A product logo is not an implementation. If the product cannot see an internal app, the partner still has to.
Why is standing admin a SOW issue?
Because the implementation team becomes your most privileged workforce. If they operate as a permanent admin user, you have added an orphan-in-waiting. Time-boxed roles and a removal date belong in the contract.
What does the diagnostic produce before we sign a long SOW?
A map of HR events, the worst leftover access, the review gaps, and the first systems we would wire. You see the revoke list shape before you buy a year of meetings. Book that call if you want the map.
Book a technical call. Call 907-841-8407, email contact@rutagon.com, or use rutagon.com/contact.