Identity & Access Management
The right people, the right access —provable at any moment
Govern who can see and do what across ZoikoTime with single sign-on, strong authentication, automated lifecycle provisioning, least-privilege roles, time-bound access, and a complete, reviewable audit trail.
Human authority remains controlling · Access decisions are attributable
Deterministic · reviewableSelected record
Unverified Exit — Pending Review
Standards-based by design. Specific protocols, provider integrations, and options vary by plan and environment — see the compatibility register.
Access Control, End to End
Everything you need to govern identity and access
Eight core capabilities that keep access least-privilege, time-appropriate, and accountable — without ever monitoring worker activity.
Single sign-on
Sign in once with your identity provider. SSO enforcement and supported protocols vary by plan and environment.
Strong & step-up auth
Multi-factor authentication, with step-up required for sensitive administrative actions.
Lifecycle provisioning
Automate joiner, mover, and leaver so access is granted and removed as roles change.
Role-based access
Least-privilege roles with segregation of duties, scoped by organization, team, and worker type.
Time-bound access
Just-in-time elevation with approval, a required reason, and automatic expiry.
Access reviews
Recurring certification campaigns so entitlements stay current and defensible.
Sessions & devices
Identifiable, revocable, audit-logged sessions with device records and recovery.
Audit & evidence
Every access event recorded with actor, reason, and time — traceable and reviewable.
Identity Lifecycle
Access that keeps up with every change
From first day to last, entitlements follow the worker record — no lingering access, no manual cleanup.
Joiner
Provision accounts and least-privilege roles from the worker master.
Mover
Adjust roles and scope automatically when a role, team, or location changes.
Leaver
Revoke access on offboarding, with a recorded, reviewable deprovisioning trail.
Lifecycle is driven by your worker master and directory sources where connected — so access reflects the organization's current reality.
Governed Access
Least privilege, enforced — not assumed
Roles, approvals, and elevation designed so sensitive access is scoped, time-appropriate, and separated by duty.
Role
Configure
Approve
Export
View records
View audit
Administrator
Policy owner
Approver
Reviewer / manager
Auditor
Worker
Role-based access & segregation of duties
Assign least-privilege roles scoped by organization, team, and worker type. Segregation of duties keeps configuration, approval, and export in different hands.
- Scoped by org, team & worker type
- No one approves their own change
- Conditional and read-only roles
Just-in-time, time-bound elevation
Request elevated access only when it's needed. Elevation requires approval and a reason, is limited to a window, and auto-revokes with an audit event.
- Approval by a different role
- Required reason on every request
- Automatic expiry & revocation
Stay Current
Prove access is right — on a schedule
Recurring certification keeps entitlements defensible, and every decision is human-made and logged.
Visibility & Control
See every session. Answer every access question.
Live session control and a complete access audit trail — so security and audit teams always have an answer.
Sessions & devices
Every session is identifiable, revocable, and recorded. Revoke a device, require step-up for sensitive actions, and give users a clear recovery path.
- One-click session & device revocation
- Step-up for sensitive administrative actions
- Approved authentication methods only — no invented claims
Access audit trail
SSO sign-in
A. Okafor · OIDC · MFA satisfied · 09:02
Role change
Approver granted to M. Diaz · reason logged · 09:14
Elevated access approved
Payroll export · 4h · time-bound · 10:05
Access auto-revoked
Elevated grant expired · 14:05
Session revoked
K. Patel · by administrator · 15:20
Audit evidence supports review, recertification, and investigations. ZoikoTime does not claim universal legal admissibility.
Enterprise Isolation
Your identity data, isolated by tenant and region
Access, data, sessions, and exports are separated per organization and follow your configured data region.
Organization A
Organization B
Tenant isolation enforced at every layer · data region & residency per configuration
Region and residency availability are published in the compatibility register; ZoikoTime does not assert options it has not verified.
Secure by Design, Not Surveillance
Strong access control — never worker monitoring
Identity & Access Management protects your organization and your workers. It governs access; it never watches activity.
Anti-surveillance invariant
No screenshots, keystroke content, URL history, application-name monitoring, or clipboard collection under any tier or configuration.
Human authority remains controlling. IAM enforces the access you configure; it does not decide employment, discipline, or legal outcomes. No security control eliminates all risk — see the Security Addendum for supported controls, certifications, and assurances.
Connects With Your Stack
Works with the identity systems you already run
Category-level connections with clear direction and ownership. Provider logos appear only for production-ready, supported integrations.
Identity providers
Sign-in and single sign-on through supported standards, where available and configured.
Directory & HRIS
Worker, role, and status context drives provisioning and deprovisioning.
Provisioning & SCIM
Automated user lifecycle through supported provisioning standards where available.
Content gate. No provider logo or specific protocol, certification, or residency claim appears until it is production-ready, documented, and verified. Until then, requirements route to Request Enterprise Demo.
Questions