Who has access? To what, why and until when?
Make an account’s group chain, business purpose and expiry visible. Explore the Harbor Access dossier, from identity lifecycle to PAM and Zero Trust decisions.
Open the identity dossierFollow an account from start to finish.
The audit team belongs to the broader reviewers group.
Does old access remain; which permission comes from the nested group?
Open the related guideScenario choices stay on this page; no real access, account progress, points or certificate is created.
Review sequence for your role
- 1Identity lifecycle: join, move and leave
- 2MFA, recovery and session security
- 3Authorization, group inheritance and separation of duties
- 4PAM, time-bound elevation and emergency access
- 5Service accounts and non-human identities
- 6SSO, OAuth/OIDC and token trust
- 7Access reviews and audit evidence
- 8Zero Trust decisions and identity incident response
8 topics, 24 explained scenarios
8 modules
Identity lifecycle: join, move and leave
Move from account tickets to verified access outcomes. Track ownership and lifecycle separately for employees, suppliers and application identities.
Beginner → intermediate → advancedMFA, recovery and session security
Look beyond an MFA-enabled label. Separate evidence for enrollment, identity recovery, phishing resistance and token/session termination.
Beginner → intermediate → advancedAuthorization, group inheritance and separation of duties
Explain who can perform which action on a resource in the local access desk. Make nested groups, expiry and explicit denies visible.
Beginner → intermediate → advancedPAM, time-bound elevation and emergency access
Review the move from standing administration to task-, target- and time-bound privilege. Connect vaulting, session evidence and emergency-access lifecycle.
Beginner → intermediate → advancedService accounts and non-human identities
Govern application, automation and AI-agent identities through ownership, purpose, federation boundaries and retirement plans.
Beginner → intermediate → advancedSSO, OAuth/OIDC and token trust
Distinguish reading JWT content from validating it. Review issuer, audience, time, redirects and consent in a complete trust chain.
Beginner → intermediate → advancedAccess reviews and audit evidence
Turn a periodic approval list into an effective access review. Track indirect permissions, business rationale, applied outcomes and time-bound exceptions.
Beginner → intermediate → advancedZero Trust decisions and identity incident response
Assess resource, identity and context instead of trusting network location. Track token scope and application outcomes during identity incidents.
Beginner → intermediate → advancedSee why access exists, beyond the role name.
Nested groups, an expired grant and an explicit deny: compute actual model decisions from two synthetic JSON files. No packages or network needed. Results do not validate live IAM, authentication or tokens.
Open the browser access deskDownload the Harbor Access kit