Building in the open — architecture specified, code in progress

tiga

Taxonomy-driven Identity Governance and Administration.

One governed vocabulary in CUE derives every name and tag in your estate. Grants converge declaratively. Accounts move through a lifecycle state machine. Everything is in git. No vendor lock-in.

The problem

Managing access across multiple systems is genuinely complex. When you're running more than one cloud platform, more than one identity provider, and growing past the point where one person knows everyone:

Resource names and tags diverge — billing-prod in GCP, BillingProd in GitHub, billing-prod-aws in AWS. Nothing speaks the same language.
Access decisions are scattered across Terraform, GitHub teams, manual role assignments, and exception spreadsheets that are months out of date.
Compliance audits mean digging through logs and dashboards across ten systems, manually assembling what you think is true.
Joiners get incomplete access. Leavers leave stale credentials behind for months.
Growing teams inherit a mess of exceptions, workarounds, and tribal knowledge about which system is actually authoritative.

How tiga works

Start with a taxonomy. Write one CUE schema defining your governance model — which names are valid, which tags are required on which kinds of things, which roles exist, which groups hold them.
Derive everything from it. Names, tags, access rules — tiga computes them from the taxonomy. Same input always produces the same output. No surprises.
Git is the ledger. Every change is a proposed change, reviewed before it lands. Full history. When you need to know "why did this person have access then?" you read the diff.
Start as read-only. Observe what's actually running and see the drift, with no risk. Move to gated changes when ready — the gate evaluates blast radius and separation of duties before you approve — then to full enforcement, where tiga converges desired state.

Where tiga sits

Identity facts flow from the HRIS into tiga; tiga converges grants and account lifecycle to target systems through connectors; Terraform pins tiga's export of names and tags when creating cloud resources; collectors observe everything read-only. — Identity facts flow in from the HRIS or directory. tiga derives grants and account lifecycle changes and writes them to target systems through connectors. Infrastructure code never sits on that path — it pins tiga's versioned export of names and tags, and collectors observe those resources back, read-only.

Status

Building in the open. Architecture fully designed and specified. The credential-free surface ships: names derive and are proven injective, the render is byte-deterministic, grants converge as a set against an in-process target, the gate evaluates a proposal end to end. Nothing reaches a target system yet — every write is in-process and every observation is a committed fixture.

Get involved

Have the access-governance problem described above? Open a discussion — tell us your setup, your constraints, what's broken. Early conversations shape the design.

GitHub repo Discussions Roadmap Architecture decisions Glossary