Warde / Joiners, movers and leavers
Joiners, movers and leavers,
on one call.
Your HR system or identity platform already knows when someone joins, moves or leaves. It calls Warde, and Warde grants or removes the right bundles, sends each item to your identity system or to the team that sets it up by hand, and keeps the record.
One call from the system that knows.
Warde does not watch your HR data. It acts on the call, and your process is the approval.
01
Your system notices
Your HR system, identity platform or a scheduled job spots the joiner, mover or leaver, as it does today.
02
It calls Warde
With the person and the bundles they should hold, or to say they have left.
03
Warde delivers
One request, a line for each item. Your identity system makes what it can; the rest go as tasks.
04
On record
Each line reads done once confirmed. The caller can ask what became of its call at any time.
Four actions cover the whole lifecycle.
- Grant
- A joiner gets a birthright bundle, such as everything a new accounts payable officer needs.
- Remove
- A mover loses a bundle. Anything they also hold another way stays.
- Reconcile
- Brings someone to exactly the bundles you list. Bundles they requested themselves are left alone.
- Deprovision
- A leaver loses everything they hold through Warde, in one request.
One REST endpoint for systems outside ServiceNow, and a Script Include for flows inside it. The caller is a service account with its own role, never an administrator. Each call carries your own id, so a call sent twice grants nothing twice.
Automatic, by hand, or both.
A joiner’s bundle usually mixes the two. Each item goes its own way under one request, so there is one record of their access.
Automatic
Items on SailPoint, Entra or Saviynt go to that system, and read done when it confirms them.
By hand
Items with no engine, and items on Okta, become tasks for the owning team, with a promised date.
Your choice of scope
Let Warde do all of it, only the engine changes, or only the tasks. Whatever it leaves comes back in the reply, item by item.
Every call gets an answer it can act on.
Your system asks with the id it sent, and Warde replies line by line.
In flight
Each line’s state, its promised date and its task number. The call reads done once nothing is queued or in progress.
Skipped
Anything Warde did not take on, each with a reason, such as access your identity system gives by its own rules.
Waiting for an account
Access for a system where the joiner has no account yet. Warde sends it when the account arrives with that system’s next sync, and after three days gives it to a person as a task.
Stuck work goes to a person.
Retried first
A call to an engine that fails is retried for up to four hours.
Then one task
Work that still fails raises a task for your failure group, naming the access, the person and what happened. The request stays open until it is settled.
Held while an engine is down
Grants and removals wait until the engine is back. Work still waiting after two days goes to a person.
Already running lifecycle in SailPoint or Entra? Keep it there.
Your platform runs it
Access your platform gives by its own rules shows on My Access as given automatically, and Warde leaves it alone: no requests, no removals, no reviews.
Your platform calls Warde
It still decides who has joined or left. The bundles, tasks and evidence sit in ServiceNow.
Split the work
The platform makes the changes it automates, and calls Warde for what someone does by hand.
Four steps to the first call.
01
Create the caller
A service account with Warde’s lifecycle role. Guard it as you would any account that can change access.
02
Build the bundles
One birthright bundle per job. Leave out what your identity platform already gives by its own rules.
03
Choose the default
Guided Setup asks whether Warde takes engine changes, tasks or both when a call does not say.
04
Point your process at it
Guided Setup shows the endpoint and code samples, then counts the requests your processes raise.
Questions about joiners, movers and leavers
Why doesn’t Warde detect joiners and leavers itself?
Your HR system or identity platform already knows, and knows more on someone’s first day than ServiceNow does. It calls Warde, and Warde turns that into access.
What if most of our onboarding is done by hand?
Each item with no engine becomes a task for its owning team, under one request for the joiner. It finishes when every task is closed complete.
How does the calling system sign in?
As a service account with Warde’s lifecycle role, by basic authentication or OAuth.
Does Warde call our system back?
No. Your system asks with the same id, and gets every line with its state and promised date.
Can a person remove access their bundle gave them?
No. What a call grants is recorded as birthright, and neither a request nor a review can remove it. Change the HR details that give it.
What if HR sends a joiner before their start date?
Warde grants nothing to a person whose user record is inactive, and says so in the reply. Send the same call again once they are active. Removals for an inactive person still run.
More of Warde
Bring your joiner checklist.
We’ll turn it into a bundle and one API call, on a live instance.
Warde is priced per user. Book a walkthrough or get in touch for a quote.