Klef

Klef is identity lifecycle management software that keeps every worker's accounts, access, and licenses in sync with the company's existing Human Resources Information System (HRIS). IT and People Operations teams write policies that describe how worker data, licenses, and access should look in each downstream system. Klef compares those policies with the connected systems, builds a plan of changes, and applies it after review. Every change is recorded against the worker and the policy that required it, which gives auditors a traceable record of who had access and why. This Identity Governance and Administration function covers the joiner, mover, and leaver (JML) cycle without manual IT tickets.

Key Capabilities

• Connectors: Klef lists 28 connectors in five categories. HR and payroll sources are ADP Workforce Now, Gusto, BambooHR, HiBob, and Deel. Identity and directory targets include Microsoft Entra ID, Oracle OCI, AWS IAM, Azure, and AWS IAM Identity Center. Productivity targets include Slack, Box, Linear, Dropbox, OpenAI, Anthropic, Atlassian, Notion, GitHub, GitHub Enterprise, Microsoft 365, and Google Workspace. The remaining targets are 1Password, Keeper Security, Bitwarden, Salesforce, HubSpot, and Oracle Fusion. Unlisted systems can be requested through the vendor.
• Automated JML: Joiner, mover, and leaver operations such as onboarding, offboarding, and role changes run from HRIS changes. Policies can also cover contractors and leave of absence, pausing access during leave and restoring it on return.
• Policy as code: Access rules are written in Klef Policy Language (KPL). A policy has a category, an applies setting (everyone or a saved segment of workers), and stage blocks for the lifecycle stages pre_start, active, leave, suspended, departing, and terminated. Each target block names one object in one connector and the fields it should have. Values can come from worker fields, lookup tables, JavaScript scripts, and stored secrets. A manager(n) function returns the worker's manager.
• Plans and review: Each plan lists the creates, updates, access changes, and removals Klef would make downstream, plus findings it cannot resolve alone, such as conflicting policies or an account that already exists. A dry run shows the effect of a policy change before anything is written. A plan moves from Generating to Ready for review to Approved before it runs. An optional workspace setting builds and applies a plan every 30 minutes.
• Account adoption: Klef never takes ownership of an existing downstream account automatically. Match rules pair existing accounts with workers, for example by matching an employee ID to a directory attribute. Ambiguous and unmatched accounts are reviewed before adoption, so duplicates are not created.
• Notifications: A policy can notify by email, Slack, Microsoft Teams, or HTTP webhook, for example to send a new hire a first sign-in link. When a target requires a password, Klef sets the first one, which is shown once and must be changed at first sign-in.
• Audit trail: Each account change is recorded with the worker it affected and the policy that required it. The audit log records the actor, action, target, time, and the channel used (web app, API, or MCP). Retention defaults to two years and is configurable from 30 days to seven years or indefinitely. Events export as CSV.
• License tracking: Klef shows how many seats of each license are assigned and how many are unused, and reclaims licenses when workers change jobs or leave. Administrators can set license prices, upload invoices, and view cost trends by system and department. The License Management capability lets finance and IT see spend tied to the workforce.
• AI agent: An assistant drafts policies, explains plans, and gives an overview of recent activity. It runs on monthly AI credits that depend on the plan.
• MCP server: A Model Context Protocol (MCP) server lets AI clients, including Claude Code, Codex, Cursor, Gemini CLI, VS Code, and Zed, read workspace data such as the inbox and propose changes. A person must approve each proposal. Access requires an administrator to enable it per member and uses an API key.

Audience & Use Cases

• Audience: IT administrators, security teams, and People Operations (human resources) teams at companies that use a cloud HRIS and want access driven by it. The vendor also publishes content for managed service providers (MSPs).
• Use Cases: Provisioning accounts and licenses on a worker's start date, changing access when roles change, removing access on the last day, proving who had access to what for audits, and reclaiming unused software licenses.

Technical Specifications

• Deployment: Cloud-hosted web application. Each workspace has its own subdomain.
• Authentication: SAML single sign-on (SSO) is included on all plans. Role-based permissions govern members, including a billing role and audit log access.
• Interfaces: A public REST API with an OpenAPI specification, plus the MCP server. MCP is available on the Standard and Enterprise plans and is rate limited to 60 calls per minute per API key.
• Plans: Launch, Standard, and Enterprise. All include every connector, unlimited workers, policies, and members, dry-run plans, and the audit trail. Standard adds MCP support and email support. Enterprise adds a named customer success manager, a priority response SLA, and hands-on onboarding.