Guide · Agent skill
How to use the Identity Governance Lifecycle Process agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This skill guides an AI agent through designing how a company manages who has access to which systems, from hiring through job changes to departure. It is aimed at IT and security teams, and at compliance staff documenting identity lifecycle controls. After this guide you will know what the skill covers, how to install it, how to ask for it in plain language, and what to check before running anything against a live tenant.
Identity Governance Lifecycle Processmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download and unzip. Download the skill ZIP from this page and unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder.
- 2Confirm the skill is loaded. Check that the skill appears under Settings, Capabilities, Skills if you use the Claude apps, or that your agent can see it in the skills folder you chose.
- 3Describe your goal. Ask for help in plain language, naming the systems involved and whether you need joiner-mover-leaver design, orphaned-account cleanup or recertification.
- 4Review the lifecycle model. Check each state and its automated actions against your HR job codes, retention rules and compliance requirements.
- 5Prepare credentials for the script only if needed. To run scripts/agent.py, set up Python 3 with requests and a Microsoft Entra ID app with the Graph permissions you need, and use a test tenant first.
- 6Verify before changing anything. Review flagged accounts with managers and HR before disabling or deleting any access.
What does the skill make the agent do?
The skill covers identity governance and lifecycle (IGA) programs on platforms such as SailPoint, Saviynt, or Entra ID Governance. Its scope includes joiner-mover-leaver (JML) automation, role mining, access requests, periodic recertification, and remediation of orphaned accounts sourced from an HR feed.
It supplies a lifecycle model with these states: pre-hire, active, role change, leave of absence, terminated, rehire, and deleted. Each state lists the automated actions that apply to it, such as disabling an account on termination or preserving role assignments during leave. The skill also includes a helper script, scripts/agent.py, that can list Microsoft Entra ID users and flag inactive accounts.
- Lifecycle state machine with valid transitions between states
- Automated actions for each stage, for example disabling the AD account and revoking application access when someone is terminated
- Retention periods, such as 90 days from terminated to deleted by default
- Guidance on role mining, access requests, recertification and orphaned-account cleanup
How do you install the skill?
Download the ZIP file from this page. Unzip it into ~/.claude/skills/ to make it available to Claude across your projects, or into a project's .claude/skills/ folder to limit it to that project.
If you use the Claude apps instead, open Settings, go to Capabilities, then Skills, and upload the ZIP there.
- Personal install: unzip into ~/.claude/skills/
- Project install: unzip into the project's .claude/skills/ folder
- Claude apps: Settings → Capabilities → Skills, then upload the ZIP
How do you trigger the skill with a natural request?
You do not need a special command. The skill's description tells the agent when to use it: automating cross-system JML provisioning, remediating former-employee access, or building lifecycle processes for SOX, HIPAA, or GDPR compliance. Describe your goal in those terms and mention the systems involved.
The skill is not meant for managing a single application's users. If your question is about one app, say so, and expect the agent to point you toward a different approach.
- Design the joiner-mover-leaver process for our Workday to Entra ID setup
- Find former employees who still have access to our systems and propose a remediation plan
- Draft the identity lifecycle controls we need to document for SOX
- Explain which automated actions should run when an employee moves to a new department
What do you need before running it?
For design work, the skill assumes an authoritative HR system such as Workday, SAP SuccessFactors or BambooHR, an IGA platform or Entra ID Governance, and a defined role structure. These are needed for real deployments, not for reading the skill.
To run scripts/agent.py you need Python 3 with the requests library, a Microsoft Entra ID tenant ID, and an app client ID and client secret with Graph API permissions. The reference file lists Graph endpoints for users with sign-in activity, access reviews, MFA registration status and access packages.
- Python 3 with the requests library (for scripts/agent.py)
- Microsoft Entra ID tenant ID, app client ID and client secret
- Graph API permissions that allow reading the user data you need
- An authoritative HR source and IGA platform for production use
What safety checks should you run first?
The script reads user data from your directory, and the lifecycle rules can disable accounts and revoke access. Mistakes therefore affect real people. Do not run it against a live production tenant until someone has reviewed the code and the rules.
Start with a test tenant or a read-only review. Check every automated action in the lifecycle model against your own policies, especially the terminated and deleted states, before any rule is enabled.
- Review scripts/agent.py before running it, since it uses the network
- Use a test tenant before production
- Confirm retention periods and deletion rules with HR, legal and compliance
- Keep audit logs, which the skill's model retains for seven years for compliance
What does a typical design session look like?
A useful session starts by mapping your lifecycle states to your HR job codes and deciding which access is birthright access. The agent can then work through each state and transition, listing the automated actions and the owner of each one.
For orphaned accounts, the helper script's inactive-account check gives you a starting list. Treat that list as a set of candidates to verify with managers and HR, not as a list of accounts to disable.
- Map HR events (hire, transfer, leave, termination, rehire) to lifecycle states
- Assign owners for each automated action
- Review candidate orphaned accounts with managers before any change
What people use it for
- Designing a joiner-mover-leaver process that links an HR system to Entra ID or another IGA platform
- Finding former employees whose accounts are still active and drafting a remediation plan
- Documenting identity lifecycle controls for a SOX, HIPAA or GDPR audit
- Planning recertification cycles and access request workflows for role owners
Frequently asked questions
How do I install the building-identity-governance-lifecycle-process skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. In the Claude apps, you can instead upload the ZIP under Settings, Capabilities, Skills.
What do I need to run the skill's script?
You need Python 3 with the requests library, a Microsoft Entra ID tenant ID, and an app client ID and client secret with Graph API permissions. The script is scripts/agent.py and it uses the network.
Is this skill free to use?
The skill is licensed under Apache-2.0. The source does not state pricing for SailPoint, Saviynt or Entra ID Governance, so check those platforms' terms separately if you plan to deploy with them.
Is this skill safe to run on a production tenant?
Not without review. The script reads user data and the lifecycle rules can disable accounts and revoke access, so test in a non-production tenant and check every rule first.
Can I use this skill to manage just one application's users?
No. The skill itself says it is for cross-system identity lifecycle work, so single-application user management is outside its scope.
What should I do if the script can't list my users?
Check that the Python requests library is installed, that the tenant ID, client ID and client secret are correct, and that the app has the Graph API permissions needed to read user data. The skill's reference file lists the Graph endpoints it calls.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits IT, security and compliance teams who are designing or automating joiner-mover-leaver processes and need a structured lifecycle model to work from. It is a poor fit for single-application user administration, or for anyone who wants to run its lifecycle rules against production accounts without a careful review.
Download the skill