Connect the dots
Link users, groups, roles and resources, including the relationships behind inherited access.
Access makes sense when you can explain it
Understand access.
See the connections.
Who has access to what, and how? Corinio brings identities, permissions and resources into one clear picture, helping you prioritise risk and document the basis for your decisions.
Read-onlyRuns in your own environment
Access is a data security control
A permission is only part of the story.
An employee joins a group. The group holds a role. The role applies to a scope containing sensitive resources. Those connections determine what the person can actually reach.
Corinio collects metadata from identity, cloud and data platforms and turns it into a shared basis for access analysis. From an individual group to the resource a role provides access to.
An AI assistant works with the permissions a person already has. Access that reaches further than it needs to therefore becomes exposure the moment the assistant is switched on. Microsoft's own guidance is to review permissions before Copilot is rolled out.
Understand the risk
Turn long lists into specific findings with a source, affected object and recommended next step.
Make the decision
Give security, platform owners and managers a common basis for reviewing access.
One access path, end to end · swipe →EntraAzure RBACInherited
Select a step in the path
StepFreja Pedersen
WhatA user in the identity platform. The analysis starts from a stable object ID, not the name.
SourceMicrosoft Entra ID
RelationUser
ScopeDemo tenant
Four steps across three systems. Nobody gave Freja access to production data. She was added to a project group two levels away from it. Illustrative example.
Law and frameworks
Access control is a requirement you have to document.
NIS2, DORA, GDPR, ISO 27001 and SOC 2 all set requirements for who has access to what. GDPR goes further and requires you to be able to demonstrate compliance.
NIS2DORAGDPRISO 27001SOC 2
Corinio breaks the requirements down into what can be measured in access data. Each article points to the controls behind it, and a control without data is shown as missing instead of passed.
Corinio · 101 seconds
The figures in the video use fictional names and data. Corinio supports the documentation. Certification and an overall assessment of compliance are separate work. Illustrative example.
Platform architecture
One access platform that brings identities together across the connected systems. Access can be searched and explained with source and object, so reviews happen on a shared basis.
See it in motion
The whole story in under a minute and a half.
From scattered permissions to an access path that can be explained, and a basis that can be documented.
Corinio · 82 seconds
The figures in the video use fictional names and data. Illustrative example.
01 · Posture
Where the tenant stands, in figures you can open
You get a score, the findings that affect it and the change since the last run. Each tile opens the records it was calculated from, so nobody has to take a number on trust.
Posture · one run
vs. previous run
never recertified
permanent, not just-in-time
Action requiredSecure Score, from the run
27▲ 5
High-risk findingsvs. previous run
19▼ 3
Groups without an ownernever recertified
4±0
Standing admin accountspermanent, not just-in-time
Illustrative figures. A real run shows your own.
02 · Effective access
One person, every platform, one picture
Identities are matched on each platform's object ids rather than on names. That makes it possible to show one person's rights in the identity platform, the cloud and the data platform in a single view.
Effective access · one identity · swipe →
Three systems, one person. No single platform sees this picture.
Insight you can act on
From a technical finding
to an informed decision.
01 / Access analysis
Look beyond direct assignments
Examine memberships, roles and grants. Distinguish direct from derived access, and follow the relationships behind it.
identity → group
↳ role → scope → resource
↳ role → scope → resource
02 / Prioritised findings
A finding should explain itself
See the affected object, the reason for a finding and a recommended action. Help the right team understand what needs investigation.
Object Explanation Action
03 / Coverage and evidence
Know what you do not know yet
Missing data is not a clean result. Corinio keeps source coverage and the available evidence visible, so you can assess each conclusion in its proper context.
One foundation. Different perspectives.
Connect security,
platform and business teams.
Focus on access that needs attention.
Add context to privileged identities, broad assignments and unclear ownership. Use the evidence behind findings to guide a focused review.
- Visibility into identities and privileges
- Specific findings and recommended actions
- Evidence for internal control and audit
Understand the permissions you manage.
Review groups, owners, memberships and roles in context. Trace the source before you plan a change.
- Direct and derived access relationships
- Groups without a registered owner
- Service principals and machine identities
Make data platform permissions understandable.
Understand Databricks identities, Unity Catalog grants and resource hierarchies. Support informed discussions about project, environment and role boundaries.
- Catalogs, schemas, tables and views
- Grants and inheritance within scope
- A foundation for least privilege review
Ask better questions about your team.
Use shared evidence to clarify access, responsibility and ownership with IAM and platform teams. Organisational views depend on your agreed source data.
- Which groups provide access?
- Who owns access and can explain the need?
- What should the team review first?
Your environment. Your control.
Access intelligence is
sensitive information, too.
Corinio is developed around customer-controlled execution. An assessment can run in your own environment, with agreed read permissions and control over the metadata collected.
Scope, operation, retention and deletion are agreed before a pilot.
Start with a specific question
From the first conversation
to informed decisions.
Scope
Agree on platforms, objectives, data types and success criteria.
Connect
Establish the agreed read permissions and execution environment.
Analyse
Collect, correlate and assess metadata with visible coverage.
Review
Review findings, uncertainties and possible next steps together.
A clearer understanding of access
Get to know
your access landscape.
Concept · 5 min.
What is effective access?
Understand the difference between an assigned role and the access an identity can gain through groups and inheritance.
Read the guidePractical guide · 6 min.
Prepare for your first assessment
Purpose, scope, read permissions and evidence: four considerations that make the first review more useful.
Read the guideMethod · 5 min.
Good evidence starts with clear boundaries
Why every conclusion about access needs its source, collection time and coverage alongside it.
Read the guideYour first questions
What to know
before we begin.
Does Corinio change our permissions?
The assessment is read-only. Corinio collects and analyses metadata and provides recommendations. Any changes follow your own controlled processes and are carried out by the responsible people in your organisation.
Does Corinio replace our IAM or IGA solution?
Corinio complements the systems that provision and manage access. It focuses on understanding and documenting existing access across the platforms included in an assessment.
Do we need to send our data to Corinio?
Customer-controlled execution is the starting point. Location, access, data types and retention are agreed for each engagement. An assessment works with identity, permission and resource metadata; reading business data would require a separate agreement if relevant at all.
Which platforms can we start with?
The current focus is Microsoft Entra ID, Azure and Databricks. Data sources, permissions and specific coverage are validated in each pilot. AWS and other systems are part of the longer-term direction and require a separate scope discussion.
Does an assessment make us compliant?
An assessment can support access control documentation and internal reviews. It is not a certification or a complete compliance assessment. Requirements, processes and other controls need to be evaluated in your own context.
Know your access.
Move forward with clarity.
Let’s start with your platforms and the questions you need answered.