CEDX Directory · Platform
Every identity in the demo directory — 340 of them — carries a source system, a status, a kind and an owner. The ones that do not are not a discovery project: they are a scored queue of 160 orphan rows.
The alert that matters is one line: 48 identities have source = None. Nothing federates, nothing syncs, and the directory says so on its own front page.
Runs on demo data. Northline Systems in the captures is the software's demo workspace, not a customer.
What it is
The Users table carries source on every row — HRIS, LDAP, Cloud IdP or Manual — next to kind, status, group count and a profile-completeness bar. The header does the arithmetic for you: 340 identities, 230 active, and 48 with no source at all.
Hygiene scores all 160 orphan rows and puts the worst on top: ghost-hire-09 at 86, three service accounts at 70–80, each with its top signal printed — no authoritative source system. Filter chips at 30, 45 and 70 turn the list into a work queue.
160 groups, and the table shows why some are a problem: all-employees with 280 members, tmp-old-81 with 106 and a nested flag, 16 sitting empty. Sprawl has a number — the worst group on the Overview scores 76 — and 34 groups have no owner at all.
Product tour
Not a mockup and not a concept deck. This is what opens at /app/directory.
01 — Overview
Hygiene health reads 84, with the components beside it: owner coverage 79%, 230 active users, 16 high-orphan accounts, 8 high-sprawl groups. The alerts are root-caused — 26 near-duplicate group pairs, 31 leavers past SLA, one service account active with no manager and no source.
02 — Users
340 rows where the columns do the governance work: source system, kind, status, group count, profile percentage, last login. A suspended engineer sourced from Manual next to an active exec from HRIS is the whole story of the directory in two rows.
03 — Hygiene
The orphan tab ranks accounts by score and prints the signal that produced it — no authoritative source system on the top rows. Group sprawl, the cleanup simulator and the scoring model are one tab over, so the rule is inspectable, not magic.
04 — Groups
all-employees at 280 members is expected; tmp-old-81 at 106 with a nested flag is not, and the table lets you see both at once. Empty groups are counted (16) and ownerless groups are counted (34), because those are the two ways a group becomes a problem.
Who runs it
Roles, not references. We have no named customers yet, so nobody in these photographs is quoted, credited or claimed as one.
Owns the joiner-mover-leaver queue. The 176 open lifecycle rows and the 31 leavers past SLA are their Monday list, not a quarterly project.
lifecycle open · 176
Owns the source mix. Every identity on Manual or None is theirs to reconcile — 110 rows in the demo directory between the two.
no source · 48
Owns the review dates on the group table and the owner coverage number — 78.8% is the figure they report, and the 34 ownerless groups are the gap.
owner coverage · 78.8%The shape of it
Every figure below is legible in the captures above. Nothing here is a projection of your estate — it is the state of the demo data.
How it runs
A hire lands from HRIS as Staged with a source system attached — one of the 150 HRIS-sourced records, not a manual entry someone will forget.
Org changes update the record and its groups; the lifecycle queue holds 176 open rows so a mover does not keep last quarter's access by inertia.
Nightly, orphans and sprawl get numbers: 160 accounts scored, 16 over the action line, 8 groups past the sprawl threshold.
Leavers deprovision against an SLA. The 31 rows past it are an alert with a cause, not a discovery at the next audit.
One record
Directory is the source of truth the rest of the estate consumes — the same identities, scored for hygiene here, secured and priced elsewhere.
The 340 identities Directory keeps clean are the principals Identity puts behind MFA and policy — same rows, different job.
CEDX AdminDirectory knows who exists; Admin knows what their seat costs. Idle accounts in one become reclaimed spend in the other.
CEDX PeopleThe HRIS feed that sources 150 demo identities is the record People maintains — hire there, staged here.
CEDX AuditLifecycle events — 176 open rows, 31 past SLA — are exactly the event classes Audit retains and scores.
Limits
Finding this out on the third call is worse for you than reading it here, and worse for us.
Start
Open it right now
Your roster, your sources
Directory with the rest of it
Questions
Yes. Every screenshot is a capture of the running build and you can open the same build at /app/directory. It runs on demo data, which the page says next to the figures rather than in a footnote.
An identity nothing authoritative claims. The Hygiene screen scores them — 160 rows in the demo directory — and prints the top signal on each row; the highest-scored ones simply read no authoritative source system, with a score like 86 attached.
Through the source mix on the Overview: 150 identities arrive from HRIS, 41 from a cloud identity provider, 39 from LDAP, 62 are manual. The lifecycle queue holds 176 open joiner-mover-leaver rows, and leavers past SLA are an alert — 31 of them in the demo data.
A group whose membership score crosses the threshold — 55 in the demo configuration. Eight groups are past it, led by review and temporary groups at 76, and the 16 empty groups are counted separately as archive candidates.
That is the design: HRIS is the authoritative feed for most of the demo directory. Which systems bind in your estate is what the estate map conversation works through.
No certification has been issued. What we can evidence about hosting, encryption, tenant isolation and production access is written up on the security page.
Live build, demo data, no card. Then ask how many identities in your own directory have no source at all.