AGMEN.

SELF-HOSTED IDENTITY GOVERNANCE

Identity,
in formation.

One record of who exists.
One model of what they can reach.

Define the access that should exist. Agmen provisions it, reconciles what comes back, and keeps the work traceable.

Follow the access
WRITTEN IN GOSELF-HOSTEDYOUR CONTROL PLANE
01 / THE GOVERNED PATHILLUSTRATIVE EXAMPLE
CANONICAL ENTITY

Morgan Lee

person · department: engineering

ACTIVE
assignment rule matches
FUNCTION

Engineering baseline

03
GRANTS
I

Source control

developers

SCIM 2.0
II

Internal tools

engineering

LDAP VIEW
III

Cloud access

reader

OPENTOFU

Reconcile observed state.
Surface the difference.

CONTINUOUS
ACCOUNTABILITY
Desired access is the instruction. Tasks carry it through.
ONE CANONICAL RECORDEXPLICIT ACCESSTRACKED CHANGESRECONCILIATION

01 / THE ACCESS MODEL

Access should
have a reason.

A person. A machine. A function they hold. An attribute that changed. Make the reason explicit, and let the system carry it through.

Agmen / Latin
An army on the march.
Many parts. One direction.

I

Grant it directly.

Give an entity a specific piece of access. A deliberate exception, with a name attached.

ENTITY ACCESS
II

Bundle it into a function.

Group access across applications. Assign the function once; provision the access it carries.

ENTITY FUNCTION ACCESS
III

Let the rule decide.

Match entity attributes or held access. Rule-derived grants follow the match as it changes.

RULE FUNCTION ACCESS

02 / FROM INTENT TO EVIDENCE

A grant is only
the beginning.

The target system has its own state. Agmen tracks the work in both directions, so intent and reality can be compared.

01

Define

Hold the canonical entities and the access they should have.

02

Dispatch

Queue provisioning tasks with retries and per-application serialization.

03

Reconcile

Read target state. Identify drift and accounts without a matching entity.

04

Account

Inspect tasks and audit records. Follow what changed and why.

For connectors that reconcile downstream state, a correct drift policy can queue corrective work. Embedded LDAP serves the governed view directly.

03 / CONNECTIONS

Different systems.
A shared intent.

Four connector paths. Choose the one your application understands.

01

SCIM 2.0

Provision through the standard identity API.

STANDARD
02

REST

Config-driven mappings for proprietary JSON APIs, including Okta and Microsoft Graph.

ADAPTABLE
03

Embedded LDAP

Serve an application-specific directory view directly from Agmen’s data.

SERVED LIVE
04

OpenTofu

Apply access through provider resources, with a local state file per application.

PROVIDER-BASED

04 / OPERATIONS

Your infrastructure.
Your identity layer.

Start with one static Go binary and SQLite. Use Postgres and worker roles when your deployment calls for them.

Environment configurationPasskey sign-inScoped REST API
LOCAL SOURCE CHECKOUTQUICK START / 01
# Build Agmen
go build -o agmen ./cmd/agmen

# Start the control plane
./agmen
THEN

Open the setup URL printed in the log, enter the one-time code, and register a passkey.

OpenTofu applications also need the tofu binary.

AGMEN.

Know who exists.
Know what they can reach.