Identity governance automation
Access reviews that run themselves, with evidence.
Governance tools review the apps they can read. For the rest, someone logs into each portal, exports the user list, and pastes screenshots into a spreadsheet before the audit.
What the rest of the stack cannot reach.
StitchOps runs the review on a schedule. It pulls the user list from each closed app, compares it to the directory, files the differences with step-level evidence, and can remediate what you approve.
Scheduled access reviews
Pull the user list from every closed app monthly or quarterly. Compare it to the directory. File the differences.
Evidence captured every run
Step-level status and evidence references per app, ready for the auditor, without the screenshot scramble.
Remediation with a gate
Orphaned and stale accounts get disabled from the review output, with a confirmation gate per account.
Results in a table you can query
Review output lands in a flex data table your GRC tool, a spreadsheet, or your AI assistant can read.
How it works with your stack.
Step 1
The schedule fires
Monthly, quarterly, or on demand before an audit.
Step 2
StitchOps pulls and compares
The agent on your worker VM logs into each closed app, reads the user list, and compares it to the directory.
Step 3
Differences are filed and remediated
Findings land in a table with evidence. Approved remediations run with a confirmation gate per account.
How it runs
Described once. Replayed every time.
Tell Stitch the task, review the typed steps, and save it. The agent runs it on a worker VM in your environment with a vaulted credential, and logs every step.
See the platform →What you can finally automate.
Run the quarterly access review across the apps outside the identity program
Verify access was actually removed and capture the evidence
Bulk-remediate orphaned accounts from the review output
Reconcile license seats in each vendor console against the directory
Governance
Ask for it in plain language.
Claude, ChatGPT or Copilot can run these from your existing assistant. The model picks from typed tools; the agent owns the credentials and stops for confirmation on anything destructive.
Connect your assistant →I found a saved workflow for this. Running it on worker-01.
tool call
workflow_offboard_closed_apps
{ "email": "j.doe@example.com" }
Confirmation required
Step 5 deactivates the user in vendor-portal. This cannot be undone by the workflow.
completed in 5.2s
3 portals · 6 steps · evidence: step_05.png, step_11.png, step_17.png
Done. The user is removed from all three portals. Evidence is attached to run_01j8k.
Start with one workflow that never had an API.
Fifteen minutes on your top three manual processes. We tell you which one to run first.