Identity Governance & Administration
Govern every identity. Verify every access.
WonderID is IGA for human and non-human identities. Employees, contractors, partners, service accounts, workloads, API keys and AI agents share one governed directory. Each identity has an owner, a lifecycle, access it can justify and a record of how that access was used. Security, privacy and compliance are built in, not bolted on.
Read-only to start. Your IdP and HR systems stay the system of record.
- WorkforceHuman
- External identitiesHuman
- Machine identitiesNon-human
- AI agentsNon-human
- GDPR
- India DPDP
- SOX ITGC
- SOC 2
- ISO 27001
- PCI DSS SAQ-A
- Tamper-evident audit
Human and non-human identities
One IGA for every identity your business runs on.
Anything that can receive, use, delegate, inherit or lose access is an identity. So WonderID governs people and non-people with the same lifecycle, the same approvals, the same certifications and the same audit trail. You don’t run a second tool for service accounts or a third for AI.
Workforce
Employees · contractors · interns
Imported from your HR and directory sources with precedence rules and review of uncertain matches. Joiner, mover and leaver changes run as governed tasks with approvals.
External identities
Partners · vendors · customers
Every external identity has an accountable internal owner. They are reviewed in the same certification campaigns as employees, so access never outlives the relationship.
Machine identities
Service accounts · workloads · API keys
Linked to the applications and accounts they run under, given an owner, and flagged when orphaned or dormant. Credentials are governed for ownership and expiry, never stored.
AI agents
Agents · copilots · MCP tools
Each agent has a contract of approved purpose, applications, data and actions. It is observed at runtime and can be stopped instantly with audited emergency controls.
One lifecycle for every identity type
- Discover
- Onboard
- Request
- Approve
- Certify
- Detect
- Remediate
- Offboard
Non-human identities (NHI)
Most identities in your estate aren’t people. Govern them like they are.
Service accounts, workloads, API keys and OAuth clients outnumber employees and rarely have an owner. WonderID brings every non-human identity your connected systems know about into one inventory and holds each to the same standard as a person: an owner, a reason for its access and a record of what it did.
- One inventory of service accounts, workload identities, OAuth clients, API keys and MCP server identities, from every connected source
- Each one linked to the application, account or AI agent it runs as, with how likely an unlinked one is to be an agent
- An accountable owner on every machine identity, and orphaned or privileged ones flagged
- Ownership, rotation evidence and expiry governed; secrets never stored or shown
- Shadow AI: activity from agents nobody registered, surfaced in a discovery inbox
- The same certifications, risk scoring and audit trail as people
The problem
Access outgrew the identities it was designed for.
Classic IGA was built for employees. Today much of your production access belongs to contractors, partners, service accounts and AI agents that act continuously. Your IAM records the credential. Nothing records the owner, the reason or the behaviour, so the questions an auditor asks have no answer inside the business.
Who owns this service account?
It was provisioned as SVC_FINANCEBOT_PRD by someone who has since changed teams. No business owner, no technical owner, nobody to approve a change to its access.
Why does this contractor still have access?
The contract ended in March. HR closed the record, but the SAP account, the Snowflake role and the shared group membership stayed open.
What did this agent do last night?
Runtime logs sit in an observability tool keyed by service name, disconnected from the identity, the entitlement and the approval that allowed it.
The gap is not that any one identity is dangerous. It is that nothing ties each identity to an owner, a reason for every grant and evidence of how the access was used. So excessive access is only discovered after it has been used.
Beyond classic IGA
Close the gap by holding all three answers at once.
Classic IGA stops at who has access. Non-human identities act on their own, so for them WonderID also compares three things: approved purpose, effective access and observed behaviour. Any divergence becomes a finding with evidence attached.
What is it approved to do?
From the agent's contract: its owner, approved applications, approved data and approved actions.
Financial reporting data · READ, REPORT
What can it technically do?
Effective access computed from your IAM — entitlements, roles, groups, scopes and tool permissions.
SAP · Snowflake/Finance · Snowflake/CustomerDB
What did it actually do?
Observed runtime behaviour, event by event, correlated back to the identity that performed it.
READ Snowflake/CustomerDB · 03:14 UTC
Effective Access (CAN) exceeds Approved (SHOULD), and Observed (DID) confirms the gap was used.
FinanceBot is approved for financial reporting data only, but holds an entitlement to Snowflake/CustomerDB — and the runtime log shows it read from there. Evidence is attached to the finding, not inferred after the fact.
Recommended
Revoke CustomerDB entitlement
Applied only after a human confirms, and the finding is re-evaluated once the access actually changes.
How the evaluation runs
One pipeline, running continuously.
Contract, entitlements and runtime events flow into the same deterministic comparison. No model decides whether access is appropriate — the rules do, and the evidence is kept.
Continuous comparison
Deterministic. Re-run on every access or behaviour change.
Excessive access, with evidence
Recorded with evidence, applied only on human approval.
Inside the product
Built for the person who has to answer for it.
Every identity in one directory, and administration precise enough that nobody holds more than their job needs — including the administrators.
Every identity, one directory
People, external partners, service accounts and AI agents side by side, each with a status, an owner and where it came from — a privileged service account is as visible as an employee.
People and their roles
Invite, suspend and remove people with a recorded reason. Every user's page shows each permission they hold and exactly which role or group gives it to them.
Roles you can reason about
System roles for common jobs and custom roles built from a published permission catalog. Nobody can design a role more powerful than they are, and assignments can be scoped and time-limited.
Policies that override any role
Deny an action, or hold it for approval, across the organization or in one environment — with a break-glass exception. Every refusal lands in the audit trail.
The platform
Every IGA capability, in one control plane.
Lifecycle, requests, certification, policy, risk and runtime assurance run on one identity model. WonderID governs identities and access. It is not an identity provider, a PAM vault or a SIEM: your IdP still signs people in, and your HR and directory systems stay the system of record for what they own.
Identity lifecycle
- One directory for people, external, machine and AI identities
- Authoritative HR and directory sources with precedence
- Joiner, mover and leaver work as governed tasks
- Identity attributes you define
Applications & accounts
- Application catalog with configure, validate, simulate, approve and promote onboarding
- Discovery of unregistered applications and shadow AI
- Every account matched to its identity
- Orphaned and dormant accounts flagged
Access requests
- Self-service catalog and access packages
- Staged approvals with escalation and expiry
- Four-eyes enforced in the database
- Separation-of-duties conflicts shown before approval
Effective access
- Entitlements, roles, groups, OAuth scopes and tool permissions resolved
- The access path behind every grant
- Saviynt, Entra, Okta, custom IAM, REST and MCP in one vendor-neutral model
Certification
- Campaigns across every identity type
- A reproducible evidence snapshot behind each decision
- Revocations go through human-approved remediation
- Evidence exports ready for auditors
Policy & administration
- Governance and request policies
- Custom roles built from a published permission catalog
- Role assignments scoped by environment, application, agent, dates or MFA
- Deny and require-approval policies with break-glass
Risk & detection
- Deterministic risk scoring for every identity type
- Excessive access, unauthorized actions and sensitive data
- Behavioural deviation and rogue agent detection
- Investigations worked to a conclusion
Runtime assurance
- A timeline of every tool call, resource and action
- Runtime Gateway ALLOW / DENY, in observe or enforce mode
- Kill switch, tool suspension and key revocation
- Agent API keys stored only as hashes, with expiry
Insights & operations
- Reports, exports and a searchable audit trail
- Notifications for approvals, findings and deadlines
- AI summaries that only advise, using your own provider key if you prefer
Security by design
Security is the architecture, not a feature.
A governance platform holds the map of who can reach what, so it has to be the hardest system in the estate to misuse. These controls are enforced in the database and the server. None of them is a UI-only check or a setting someone forgot to turn on.
Tenant isolation in the database
Every customer table carries a tenant id protected by PostgreSQL row-level security. Your organization is identified from your signed-in session, never from anything the browser sends.
Rules decide, not AI
Authorization, risk, policy and remediation are decided by rules you can read. AI drafts summaries and proposals but never makes a decision, and imported content cannot instruct it.
A person approves consequential change
Grants, revocations, overrides and destructive remediation wait for a person to approve them. The database enforces four-eyes and separation of duties, not just the UI.
Tamper-evident audit trail
Every security-sensitive action records the actor, target, outcome and correlation id. Entries are append-only and SHA-256 hash-chained per organization, and the chain can be verified in the product.
Strong authentication
SAML and OIDC single sign-on, Google, Microsoft and LinkedIn sign-in, authenticator-app MFA and idle and absolute session limits. Signing out ends every session.
Secrets never exposed
Integration credentials are encrypted with AES-256-GCM under rotatable keys. They never reach the browser or the logs. Agent API keys are kept only as hashes.
Read-only connectors by default
Connectors declare what they can do, and a read-only connector never writes. Remediation runs through your own IAM workflow, and only after approval.
Runtime containment
The Runtime Gateway allows or denies agent actions as they happen. In one audited step, a kill switch stops an agent, suspends its tools or revokes its keys.
Hardened web and supply chain
HSTS preload, a strict content security policy and cross-site request blocking. Every change runs type checks, tests, a dependency audit and a secret scan.
Privacy & compliance
Privacy and compliance, built into the product.
Privacy law, financial controls, security frameworks and payments are part of the product, not an add-on. WonderID gives you the controls and the evidence; your auditors and regulators decide compliance.
Privacy
GDPR and India DPDP built in
Handle data-subject and data-principal rights within their legal deadlines, keep records of processing, and prove consent for every person whose identity data you govern.
- Access, correction, erasure, grievance and nomination requests with legal deadlines
- One-click data export and consent withdrawal for every member
- Breach register with the 72-hour GDPR and DPDP Board clocks
- Retention schedules, legal holds and four-eyes erasure
Financial compliance
SOX-ready evidence
Access reviews, separation of duties and approvals become evidence your auditors can rely on, kept in an audit trail nobody can quietly edit.
- Tamper-evident audit trail: append-only and SHA-256 hash-chained
- Control libraries for SOX ITGC, SOC 1, PCI DSS, GLBA, DORA, RBI, SEBI CSCRF and CERT-In
- Maker-checker on access and on financial adjustments
- Seven-year audit retention on Enterprise
Security & AI governance
Mapped to the frameworks you report on
Certification decisions, policies and audit evidence map to security and AI governance controls, so one review answers several frameworks at once.
- ISO/IEC 27001 and SOC 2 access-control evidence
- ISO/IEC 42001 and NIST AI RMF for AI agent governance
- NIST CSF identity and access outcomes
- Evidence snapshots that reproduce exactly what a reviewer saw
Payments
Stripe and Razorpay billing
Upgrade, renew and cancel in the product. Cards, UPI and net banking are entered only on Stripe's or Razorpay's hosted pages, so WonderID never touches payment data (PCI DSS SAQ-A).
- INR through Razorpay with RBI e-mandates; USD and EUR through Stripe
- Signed, replay-protected and idempotent webhooks
- GST-ready invoices: GSTIN validation, CGST/SGST or IGST, consecutive numbering
- Refunds and plan overrides need a second approver
Control libraries included
Map certifications, policies and audit evidence to the frameworks you report against.
- GDPR
- UK GDPR
- India DPDP
- SOX ITGC
- SOC 1
- SOC 2
- ISO/IEC 27001
- ISO/IEC 42001
- NIST CSF
- NIST AI RMF
- PCI DSS
- GLBA
- EU DORA
- RBI
- SEBI CSCRF
- CERT-In
Control mappings and evidence support your auditors. They are not a certification, and using WonderID does not by itself make an organization compliant with any framework.
What’s new
Recently shipped.
WonderID started with AI agents. It now governs people, external users, machine identities, applications and access requests too, with the same deterministic controls underneath.
Billing
Pay with Stripe or Razorpay
Choose a plan, pay on the provider's secure page, and download GST-ready invoices. Cancel any time, effective at the end of the paid period.
Privacy
GDPR and DPDP privacy centre
Rights requests within their legal deadlines, records of processing, consent, retention, legal holds and a breach register, plus a My privacy page for every member.
Assurance
Tamper-evident audit trail
Audit entries are append-only and hash-chained. Audit Integrity proves nothing was altered, and financial control libraries cover SOX, PCI DSS and more.
Authorization
Scoped roles and explicit policies
Limit a role to production, to chosen applications or agents, to a date range or to MFA sessions. Add deny or require-approval policies that override any role, with a break-glass exception.
Access governance
Requests, approvals and access packages
A request catalog with policies, a staged approval engine with escalation and expiry, and access packages that assign bundles of access in one request.
Identities
Authoritative sources and lifecycle
Import people from HR and directory sources with precedence and review of uncertain matches, then run joiner, mover and leaver work as governed tasks.
How it works
From unknown identities to certified access.
- 01
Connect what you already run
Bring in people from your HR and directory sources, accounts and entitlements from your IAM and applications, and runtime events from MCP or REST sources. Read-only until you say otherwise.
- 02
Give every identity an owner
People, external users, service accounts and agents each get an accountable owner and a lifecycle. For AI agents, the approved applications, data and actions become Approved (SHOULD).
- 03
Control how access is granted
People request access from a catalog; approvals run in stages with four-eyes and separation of duties; roles, groups, scopes and policies decide who may administer what.
- 04
Detect, certify, remediate
WonderID compares approved, effective and observed access, raises evidence-backed findings, runs certifications, and waits for a human to confirm every consequential change.
Pricing
Start free. Pay as you grow.
Every plan has the whole product. Choose by how many people, agents and integrations you govern, and how long you need to keep audit history.
Free
Try WonderID on a small team and its first agents.
$0
No card needed
- 3 users
- 5 AI agents
- 1 integration
- 10,000 runtime events a month
- 1 year of audit history
Pro
For a team governing its identities and agents in production.
$499/ month
Billed monthly · plus applicable tax
- 25 users
- 50 AI agents
- 5 integrations
- 250,000 runtime events a month
- 1 year of audit history
Max
For organizations running many agents across many systems.
$1,499/ month
Billed monthly · plus applicable tax
- 100 users
- 250 AI agents
- 20 integrations
- 2,000,000 runtime events a month
- 3 years of audit history
Enterprise
For large organizations that need custom terms and scale.
Custom
Priced for your organization
- Limits sized to your organization
- 7 years of audit history
- Annual contract and invoicing
Every plan includes the whole product — identities, non-human identities, AI agents, access requests, certifications, risk and audit. Plans differ only in scale and how long audit history is kept. Choose or change a paid plan in Administration → Billing after you create your organization; you pay on Stripe’s or Razorpay’s secure page, and cancelling takes effect at the end of the period you paid for.
Know who and what has access, why — and whether it still should.
Create your organization, invite your team and connect your first source in minutes.