Ask three systems who an employee is and you will get three answers. HR has one job title, Active Directory another, the ERP a third - plus a duplicate account from a surname change in 2019. This is not an inconvenience; it is the root defect beneath most identity security failures. Provisioning automates the wrong facts. Access reviews certify entitlements attached to identities nobody can confidently match to people. Deprovisioning misses the duplicate. Every downstream control is only as good as the identity record it reads - and in most enterprises, there is no single record to read.
The enterprise challenge: identity data without an owner
Identity fragmentation accumulates the same way application sprawl does. Each system arrives with its own user store, populates it by import or hand-entry, and updates it on its own schedule - or never. Attributes drift apart: departments reorganise in HR but not in the directory; contractors exist in project systems but nowhere authoritative; leavers vanish from payroll while their scattered accounts persist. The operational symptom is constant reconciliation work. The security symptom is worse: access decisions - who should authenticate, what should be provisioned, which entitlements belong to whom - are being made against data that is partly fiction.
Why synchronisation scripts do not create truth
The common remedy is point-to-point synchronisation: scripts copying attributes between stores on schedules. This moves data without establishing authority - when two stores disagree, the scripts have no principled answer about which is right, so conflicts are resolved by overwrite order and luck. Sync also multiplies quadratically with stores and breaks silently when schemas change. What the estate needs is not more copying but a designated authority: one place where identity is defined, from which everything else derives.
The Tanflow approach: a directory that everything else obeys
The Tanflow IAM Suite is built around exactly this principle. The Identity Directory is the platform's one authoritative source of truth for every identity and attribute - employees, contractors, every population - fed from the HR source of truth and governing everything downstream. Tanflow's platform architecture makes the arrangement explicit: an encrypted identity store in the data layer, engines for authentication, provisioning, policy and audit reading from it, and an integration layer - SAML 2.0, OAuth2/OIDC, SCIM, Active Directory connectors and REST APIs - connecting it to HRMS, directories and business applications.
Authority changes the behaviour of every capability that consumes it:
- Authentication and SSO assert attributes from the directory - so federated applications receive the current truth, not a stale copy.
- Lifecycle automation keys joiner-mover-leaver events off directory state, which itself tracks HR - so access follows reality.
- Provisioning and SCIM push the directory's target state outward and reconcile connected systems against it - drift is detected rather than accumulated.
- RBAC and dynamic policies compute entitlements from directory attributes - and recalculate when the attributes change.
- Organization management models business units, hierarchy and delegated administration on top of the same record - structure, not another silo.
What consolidation looks like in practice
- The HR system feeds the directory as the source of identity events; the directory becomes the enterprise's canonical answer to "who is this person and what is true about them".
- Connected systems consume rather than compete: applications federate for authentication, target systems receive provisioned accounts, and local stores are reconciled against the directory's intent.
- Conflicts surface as findings with a defined resolution - the directory's record governs - instead of silently coexisting.
- Every attribute change, and every downstream effect it triggers, lands in the audit trail.
Enterprise scenario
Consider an enterprise that has grown through acquisition, inheriting three HR systems' worth of identity records and duplicate accounts across overlapping directories. Standing up the Tanflow Identity Directory as the merge point gives the integration a spine: each population is loaded and matched once, the surviving canonical identities drive provisioning into the combined estate, and reconciliation flags the orphans and duplicates the merger left behind. The security team's long-standing unanswerable question - exactly how many active identities do we have - becomes a directory count.
Governance and audit implications
An authoritative directory is what makes governance answers trustworthy. "Who has access to what and why" resolves through a chain - entitlement to role, role to attribute, attribute to HR event - only when every link reads the same record. Auditors reviewing against the frameworks Tanflow maps to encounter a materially stronger posture: one identity store, encrypted, inside the organisation's own perimeter, with a complete and exportable change history - rather than a dozen stores with a dozen partial stories.
Conclusion
Identity security programmes fail quietly at the data layer long before they fail visibly at the control layer. The Tanflow Identity Directory fixes the foundation: one authoritative record of every identity and attribute, fed by HR, obeyed by provisioning, policy and authentication alike - so that every access decision in the enterprise is finally being made about the same, true person.