Access work used to be a ticket. Now it is an agentic task that becomes a pull request: permission sets and assignment rules for AWS IAM Identity Center, in Terraform.
Daily access should go through IAM Identity Center, not IAM users in member accounts. Ticket work becomes a GitHub issue, then a pull request. Never a direct assignment. Never assign outside git.
The catalog is the source of truth: groups, permission sets, and which accounts they attach to. Standards live in the workflow, not in a wiki Security hopes someone read. Terraform and YAML only. No console clicks.
Issue, not a ticket queue
Someone asks for access the way people actually talk: who needs what, on which account, for how long. The agent resolves that English into accounts, scopes, permission sets, and a least-privilege posture that can survive audit.
06 · System map
Identity Agent · IAM Identity Center.
A plain-language GitHub issue in. Structured Terraform and YAML out. Human merge before Identity Center.
Intake
Issue, not a ticket queue
GitHub issuePlain-language access request. What used to be a ticket.
Ask in EnglishThe agent resolves:
Accounts and scopes
Permission sets
Group / user targets
Least-privilege posture
Audit-ready change
Identity Agent
Emits structured change
Permission sets Named roles for Identity Center.
Scoped policies Least privilege as code.
Assignment rules Group / user → accounts.
Scale · identity as code
The estate the agent maintains
~140 Permission sets
~800 Assignment rules
98 Policy files
Terraform and YAML only. No console clicks.
Governed path
Git first · Identity Center last
One write path · pull request · never assign live
01Identity-as-code repoPermission sets, policies, assignments land in git.
02CI + least-privilege reviewSame contract as infrastructure: validate, plan, policy.
03Human mergeSensitive access still needs a person. Then Identity Center.
Output · the only write
Auditable pull request
Never apply without human merge.
On merge: permission sets and assignments reach Identity Center.
Adjacent · sits beside, not inside. Admin portal (Rails + Claude-on-Bedrock): email and forms become GitHub, Copilot, Entra, and Jira actions. Identity Agent is a sibling path for permission sets as code — not a feature of the portal.
A plain-language GitHub issue in. Structured Terraform and YAML out. Human merge before Identity Center.
Identity as code
Named, typed, scoped. The pull request is the only write. Fail, and the agent iterates. Pass, and a human merges sensitive access. Assignment onto accounts happens after that merge, not before.
04 · Identity as code
Identity Agent · runtime.
Ticket work becomes a GitHub issue, then a pull request — never a direct assignment.
Engineer
Identity Agent
Identity-as-code repo
CI
Identity Center
fail · iteratepass
01GitHub issueWas a ticket · plain language
06Approve · mergeSensitive access · human
02Route + schemaNamed, typed, scoped
03Write TF + YAMLPermission sets · policies
04Open pull requestThe only write
05CI + least privilegeSame contract as infra
07AssignmentSets onto accounts
01
Engineer
GitHub issueWas a ticket · plain language
02
Identity Agent
Route + schemaNamed, typed, scoped
03
Identity Agent
Write TF + YAMLPermission sets · policies
04
Identity-as-code repo
Open pull requestThe only write
05
CI
CI + least privilegeSame contract as infra
06
Engineer
Approve · mergeSensitive access · human
07
Identity Center
AssignmentSets onto accounts
Scale in the repo: ~140 permission sets · ~800 assignment rules · 98 policy files. Never assign outside git.
Ticket work becomes a GitHub issue, then a pull request — never a direct assignment. ~140 permission sets · ~800 assignment rules · 98 policy files. Never assign outside git.
Describe the intent, bind it to a catalog, emit infrastructure as code, and keep a person on the merge. The same loop works for IAM, landing zones, and app-team cloud requests.