Single sign-on, federation, authorization and session control on open standards — with every decision expressed as a step you can see, change and re-run, instead of logic buried inside the applications that happen to enforce it.
Three shifts moved the centre of gravity away from the moment somebody types a password.
A token issued this morning is still being honoured this afternoon, long after the laptop fell out of compliance or the contract ended. Authentication used to be the only moment access management cared about, and it is no longer the moment that matters most.
Every application ended up with its own idea of what a role means, written in its own code and auditable only by reading that code. Fine-grained decisions are moving out of applications and behind an interface that the people who own the policy can actually inspect.
Employees, customers, partners, suppliers, service accounts and now software agents all need access, at different assurance levels, across systems no single directory ever owned. Access management became a routing problem before it became a security problem.
Monokee treats the third one as the design problem: access is a route through systems you do not all own, and a route is something you draw rather than something you hard-code.
The pieces that decide who gets in, what they can do once they are in, and for how long that stays true.
One sign-in across internal applications, SaaS and partner systems. Monokee acts as identity provider, as service provider, or as a broker between the two — so an identity provider you already run does not have to be replaced in order to be included.
SAML 2.0, OpenID Connect, OAuth 2.0, LDAP, RADIUS, SCIM and WebAuthn are spoken natively. What speaks a standard stays portable; a bespoke connector becomes the exception rather than the architecture.
A session has a lifetime, a scope and conditions attached to it. It can be shortened, elevated or ended from outside the application, instead of waiting for the next login for a policy change to take effect.
Roles, groups, attributes and entitlements decide what happens after sign-in. Policy is held centrally and applied at the point of access, so each application does not have to keep its own drifting copy of the rules.
Assurance is raised only where the risk justifies the friction: an unrecognised device, an unusual location, a transaction above a threshold. The rest of the time nobody is interrupted for the sake of it.
Service accounts, machine identities and software agents acting on behalf of a person need scoped, short-lived credentials and an auditable link back to whoever authorised them. The access layer is where that delegation is granted and revoked.
Every proprietary shortcut is a future migration. These are spoken natively, which is what keeps an application replaceable and an identity provider optional.
Different clients need different grants: a single-page application, a mobile app, a legacy service and a third-party portal do not start a session the same way.
The interesting decision is rarely the first one. A device falls out of compliance, a risk score moves, an entitlement is revoked — and the question is whether the session already running gets to continue.
Continuous, event-driven session signals are an area the whole industry is still building out. Which signal sources your deployment can consume today is a conversation worth having with us rather than an assumption to take from a diagram.
Sign-in, step-up, token issuance and refusal are nodes on the same canvas as the rest of the identity journey — not a separate product with its own console and its own idea of what a policy is.
Changing who gets asked for a second factor becomes an edit to a diagram that can be reviewed and versioned, rather than a ticket for whoever owns the application. The people who set the rule are the people who can read it.
See the Visual Identity OrchestratorAccess management that requires a clean slate is a migration project wearing a product name. These are already covered.
Microsoft Entra ID
Google Workspace
Active Directory / LDAP
AWS IAM Identity Center
FIDO2 security keysWe'll map it onto the canvas with you and show you what it takes to run it.
Talk to an expert