CtrlK
BlogDocsLog inGet started
Tessl Logo

building-identity-governance-lifecycle-process

Design identity governance and lifecycle (IGA) programs on platforms like SailPoint, Saviynt, or Entra ID Governance, covering joiner-mover-leaver (JML) automation, role mining, access requests, periodic recertification, and orphaned-account remediation sourced from an HR feed. Use when automating cross-system JML provisioning, remediating former-employee access, or building lifecycle processes for SOX, HIPAA, or GDPR compliance.

64

Quality

77%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Medium

Suggest reviewing before use

Fix and improve this skill with Tessl

tessl review fix ./skills/building-identity-governance-lifecycle-process/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

55%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is well-structured and domain-rich but token-heavy, leaning on illustrative template code and a mock report while re-explaining known concepts. It omits validation/feedback loops for destructive batch operations and, despite shipping useful bundle files, never references them from the overview.

Suggestions

Trim the inline Python templates and 'Key Concepts'/'Output Format' sections to the essentials, offloading full implementations to the existing references/ and scripts/ bundle and linking to them explicitly.

Add explicit validation checkpoints and a fix-and-retry loop to the termination and orphan-remediation workflows (e.g., verify HR correlation before disabling, re-detect after remediation).

Wire the overview to the bundle: add a '## References' or '## Tooling' section linking to references/api-reference.md and scripts/agent.py so readers reach the executable tooling.

DimensionReasoningScore

Conciseness

The body is heavily padded with ~400 lines of largely illustrative Python and a long mock report; the 'Key Concepts' table re-explains terms (JML, birthright access) that an expert model largely already knows, so much of the token spend is unnecessary.

2 / 3

Actionability

Code blocks are detailed but function as templates/pseudocode rather than copy-paste executable tooling — methods reference unimplemented helpers (self.iga.get_identity, risk_catalog.get_risk_level) and the inline Workday connector is illustrative rather than runnable end-to-end.

2 / 3

Workflow Clarity

Five workflow steps are clearly sequenced, but for destructive batch operations (termination disablement, orphan remediation) there are no explicit validation checkpoints or fix/retry feedback loops; the rubric caps such workflows at 2.

2 / 3

Progressive Disclosure

Real one-level-deep bundle files exist (references/api-reference.md, scripts/agent.py), but the SKILL.md body never signals or links to them, so the overview fails to navigate readers to the available detail; the inline ~400 lines could itself have been offloaded to references.

2 / 3

Total

8

/

12

Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that names concrete IGA capabilities, natural trigger phrases, and an explicit 'Use when' clause scoped to compliance and lifecycle automation. It is specific, complete, and clearly differentiated from adjacent security skills.

DimensionReasoningScore

Specificity

Lists multiple concrete capabilities — 'JML automation, role mining, access requests, periodic recertification, and orphaned-account remediation' — each tied to specific platform actions.

3 / 3

Completeness

Explicitly answers 'what' (the listed IGA capabilities) and 'when' via a clear 'Use when automating cross-system JML provisioning, remediating former-employee access, or building lifecycle processes for SOX, HIPAA, or GDPR compliance.' clause.

3 / 3

Trigger Term Quality

Covers natural terms a user would say — 'automating cross-system JML provisioning', 'remediating former-employee access', 'SOX, HIPAA, or GDPR compliance' — alongside platform names users mention.

3 / 3

Distinctiveness Conflict Risk

Targets a clear IGA niche (joiner-mover-leaver, recertification, orphaned accounts) anchored to named platforms and compliance frameworks, making it unlikely to trigger for unrelated skills.

3 / 3

Total

12

/

12

Passed

Validation

87%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation14 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

skill_md_line_count

SKILL.md is long (720 lines); consider splitting into references/ and linking

Warning

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

14

/

16

Passed

Repository
mukul975/Anthropic-Cybersecurity-Skills
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.