Lifecycle & Access Governance
Remove Access
Remove the privileges that no longer fit, each as its own request with a justification on the record.
Completes when each privilege you picked is revoked in its target system, once approved.
https://mcp.avatier.com/mcp
Ask in Plain Language
Run Remove Access from the AI Assistant You Already Use
Same policy, approvals and Justification as the web app, with identity verification first in Avabot and MCP. One completed access removal = one Secure Outcome; failed attempts are never billed.
You: Remove Alex Kim's access to the Finance Share group. Reason: role change. Avatier: verify: passed · privilege: Finance Share · reason: role change · request: submitted, may need approval
Why it matters
Access That No Longer Fits Should Not Stay Assigned.
People change jobs and projects end, and the privileges they no longer need stay assigned until someone removes them.
What a removal needs
The privileges that no longer fit, picked from what Avatier has recorded as assigned to the person, including privileges that came with a role, with a justification.
What goes wrong by hand
Removing access by email or ticket leaves no request per privilege, no approval record and no activity-log entry to show it happened.
What Remove Access does
Each privilege you pick becomes its own removal request, with a justification, routed for approval when the privilege's removal workflow is on, and revoked in its target system once approved.
What per-seat pricing charges
Per-seat IAM charges for every licensed seat, whether any access is removed this month or not. Pay Per Identity Action™ charges only for completed removals.
The Action
How Remove Access Runs
On the web, Remove Access walks through these screens. In Avabot and MCP you verify, name the user, pick one privilege from a numbered list, give a reason and confirm.
Verify in Avabot or MCP
Avabot and MCP only. Remove Access starts with identity verification in the conversation, with the methods your policy already allows, such as Security Questions, Google Authenticator, PingID Push or Identity Challenge Card. A verification earlier in the same conversation carries over.
Identity Verification (Avabot and MCP)
Select the User
Pick the user whose access is being removed: yourself, or someone your Lifecycle Management authority lets you request for. Workflow admins are then asked "Would you like to use workflow?"
Give the Reason
On the workflow path, choose Remove Access Now and enter a Justification.
Pick the Privileges
On the Remove Access list, in icon, list or detail view, search and tick the privileges to remove, or use Select all. Items already pending are flagged.
Remove
Tap Remove. Each privilege becomes its own removal request, recorded in Request History with a Request ID, and goes to approval when the privilege's removal workflow is on.
Approval point
Available on Web, Mobile, Teams, Avabot chat and MCP.
Avabot chat and MCP require the current (.NET 10) Avatier server.
In Avabot chat and MCP, each request removes one privilege and always goes through workflow.
Secure Outcome
What Counts as Done
A Secure Outcome is a completed, verified, policy-compliant identity action. An access removal completes when each privilege you picked is revoked in its target system: once approved, or at once when a workflow admin removes it without workflow. One completed access removal = one Secure Outcome.
Evidence
- A Request ID for each privilege in Request History (exportable)
- An activity-log entry for each removal
- The "Remove access request successfully submitted" notification
Guardrails
Your Assistant Asks. Avatier Decides.
Verified First
Avatier verifies the person before sensitive changes, with the methods your policy already allows.
Acts as the Signed-In User
OAuth sign-in to your own tenant. No shared service account, no API key to manage.
Never Makes Up Values
The connector only sends what the person actually said, and asks when something is missing.
Every Request Recorded
Requests land in Request History, ready to review and export.
Pay Per Identity Action™
Pay per Completed Removal
Pay per completed removal. Failed attempts are never billed.
| Compared | Manual or Per-Seat IAM | Remove Access, Pay Per Identity Action™ |
|---|---|---|
| What you pay for | Every licensed seat, whether it acts or not | Completed removals only |
| Failed attempts | No line between an attempt and a result | Attempts, failures and retries are never billed |
| The work | Manual intervention or tickets | Each privilege is revoked in its target system once approved, as its own request |
| Evidence | Silent failures and missing audit trails | A Request ID and an activity-log entry for every privilege removed |
Pay Per Identity Action™ is in invitation-only preview. Pricing is shared with qualified organizations.
Works with the Systems Remove Access Touches
Remove Access revokes each privilege in the system it lives in, through that system's connector, such as Active Directory or Entra ID group memberships, LDAP or application entitlements.
- LDAP
- Microsoft
- Active Directory and Entra ID group memberships, through their connectors.
- Other Systems
- LDAP and application entitlements, through their connectors.
Avatier MCP
New to Avatier MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
Up and Running in Under a Minute
One URL works in every MCP client. Pick yours, copy, paste, sign in.
Microsoft Copilot Studio
Claude Code
OpenAI Codex
Cursor
Frequently Asked Questions
If I pick a future date, does the access stay until then?
Not today. For privileges the date is ignored and the removal request is filed immediately.
Who approves a removal?
A removal follows the privilege's removal workflow, which is on by default, and your tenant's approval settings. Admins can turn removal approval off per privilege, or remove directly as a workflow admin.
Can users remove their own access?
Yes, if they hold the Remove Access delegation. The request still routes for approval as configured.
Can I remove access for many users at once?
No. On the web you can select several privileges for one user; Avabot removes one privilege at a time.
Is Avatier secure enough for large enterprises or regulated industries?
Absolutely. Avatier applies zero-trust controls, maintains fully auditable identity records, and holds SOC 2 Type II and ISO 27001 certifications. It also helps organizations support requirements and evidence needs associated with NIST, SOX, HIPAA, and GDPR. Every provisioning action is policy-enforced and auditable.
Does Avatier provide AI-driven compliance reporting?
Yes. Avatier turns continuous identity and access data into audit-ready reports on demand, using AI to assemble who has access to what, what changed, and who approved it, mapped to the controls auditors expect. Instead of a manual evidence scramble before each audit, you generate plain-language, exportable reports covering SOC 2 Type II and ISO 27001, plus the evidence needs associated with NIST, SOX, HIPAA, and GDPR.
What is AI-driven configuration?
Avatier's AI-driven config turns plain-language intent into working policy. Rather than hand-coding rules, connectors, and roles, administrators describe what they need and Avatier recommends and sets up provisioning rules, role mappings, and workflows, then validates them before they go live. It shortens deployment from months to days and keeps configuration consistent, auditable, and free of custom scripting.
What is Pay Per Identity Action™?
Pay Per Identity Action™ is Avatier's pricing mechanic. Customers pay only for completed, verified, policy-compliant identity actions, called Secure Outcomes.
Is it the same as pay-per-action advertising?
No. Pay per action (PPA) is performance-marketing vocabulary for paying when an ad converts. Pay Per Identity Action™ charges for completed identity work.
How do I get started?
Getting started is free, deployment services are included, and a 45-day money-back guarantee applies. Contact Avatier for pricing for your organization.
What is MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
How is it billed?
Pay Per Identity Action™ is in invitation-only preview: each completed, verified action is one Secure Outcome, and attempts, failures and retries are never billed.
Remove Access
You've Automated the System. Now Secure the Lifecycle.
Pick the privileges that no longer fit, give a reason, and each removal is recorded in Request History with a Request ID.