Identity provisioning for 1,000+ users across 600+ groups
A PE-backed global media and marketing agency
Access to Notion and Claude across the organisation is provisioned automatically from the HR system, covering more than 1,000 users and over 600 groups, where a single person can belong to many groups at once. The agency's internal IT team was over capacity and could not take the build on, so 1AYM built the system from scratch rather than forcing the model into off-the-shelf group tooling. It has run reliably for seven months. Doing this membership matrix by hand was never realistic — and manual provisioning is how leavers keep their access.
- Users provisioned
- 1,000+Users provisioned
- Groups managed
- 600+Groups managed
- Running in production
- 7 monthsRunning in production
- Single source of truth
- HR systemSingle source of truth
The problem
Two tools needed access managed across the whole organisation, against a membership model where one person belongs to many groups and group membership changes as people join, move and leave.
Done manually, a matrix of that size is not merely tedious — it is unreliable in a specific and dangerous way. Manual provisioning fails safe on joiners, because someone complains when access is missing. It fails unsafe on leavers, because nobody complains about access that should have been removed. That asymmetry is how organisations accumulate active accounts belonging to people who left months ago.
Why it was built rather than configured
The internal IT team was over capacity and did not have the time to take it on, which is the ordinary reason this kind of work does not get done anywhere.
Off-the-shelf group tooling was considered and rejected. The organisation's membership model — overlapping groups, HR as the source of truth, two target systems with different provisioning semantics — did not fit the shape those tools assume, and bending the model to fit the tool would have left the mismatch to be handled manually anyway.
How it works
- HR as the source of truth
- Provisioning is driven from the HR system, so joining, moving and leaving are reflected without a separate administrative step that someone has to remember.
- Deterministic identity resolution
- Matching a person across systems is done by explicit rules rather than fuzzy heuristics, because a wrong match grants the wrong person access.
- Diff-based writes
- Each run computes the difference between intended and actual state and applies only that, so a run is idempotent and a retry cannot compound.
- Dry-run mode
- Changes can be inspected before they land — necessary when a single run can alter access for hundreds of people.
- Audit trail and rollback
- What changed, for whom, and why, with a defined path back from a bad run.
Outcome
The system has run for seven months. Access reflects the HR system rather than someone's memory, joiners are provisioned without a ticket, and leavers lose access because a record changed rather than because somebody noticed.
This was built inside the wider enablement engagement at the same organisation, and shares its engineering defaults: idempotency, dry runs, auditability and rollback are the baseline rather than additions.
SCIM · Notion · Claude · HR system integration · Deterministic identity resolution
Related
Written at a public-safe level: client names, internal project names and proprietary business logic are held back by agreement.
Last reviewed