Product Management · Digital Identity & Access Management
AccessOS models identity, risk, and regulation as one product.
A platform serving AMCs, distributors, and investors puts a retail investor, a distributor's sub-users, a compliance officer, and a platform engineer through the same front door — each needing a different, provable level of access to the same underlying data. AccessOS models identity, attributes, and regulatory risk as one policy engine instead.
The demo runs it live: pick a persona, change one attribute, attempt an action, and watch the decision — and the plain-English reason for it — change in real time.
Open the AccessOS demo →- Zero standing elevated access
- Incident reduction illustrative
- Time-to-access illustrative
- Audit findings closed illustrative
- % of elevated engineer access converted to JIT illustrative
See it work
A full pass through the demo — six personas, an attribute toggle, a denied and an allowed attempt, and the platform engineer's request → approve → auto-expire PAM flow, all streaming into the live audit log.
What this actually produced
Illustrative targets
The design is targeted at these live-platform metrics. They are not measured here.
The problem, as most platforms have it
Complex identity & access landscape
ChallengeBuild access control for a platform where an investor, a distributor's sub-users, an AMC's ops team, a compliance officer, and a platform engineer all interact with the same underlying data.
Core problemDifferent actors, relationships and levels of access need to coexist without exposing more data or capability than necessary.
Static authorization vs. changing regulatory state
ChallengeRole-based permissions alone are too coarse for a regulated ecosystem. Access can depend not only on who the user is, but also on their relationship to the data, business attributes, and changing regulatory state.
The edge caseWhat happens when a distributor's ARN is suspended, or an investor's KYC moves to an on-hold status?
Core problemA change in regulatory state needs to translate into a timely and consistent authorization decision.
Six personas, one policy engine
- InvestorRetail investor managing their own account — unverified KYC blocks transacting outright; step-up MFA is required only on high-value redemptions.
- Distributor Sub-userJunior relationship-manager login — view-only, and blocked entirely from an untrusted device.
- Distributor AdminMFD/RIA firm admin — can export the client book, but only within business hours.
- Compliance OfficerSEBI/AMFI compliance function — standing access to the audit log, but PIT-restricted client data needs a logged case, not standing visibility.
- Platform EngineerZero standing production access — every access is requested, approved, time-boxed, and auto-expires.
- SuperAdminEvery action logged as high severity — MFA required unconditionally, no exceptions.
The domain model underneath
The demo is one policy engine, but the model behind it is the full IAM vocabulary a platform like this needs to reason with:
What clicking through actually proves
Mapped to the skills a Digital Identity & Access Management PM role screens for — each one is a live behavior in the demo, not a slide claim.
- RBACActions are gated by role — only a Distributor Admin can export; a sub-user cannot.
- ABACThe same role gets a different outcome depending on KYC status, device trust, business hours, or an attached case ID.
- Identity lifecycleUnverified KYC blocks transacting entirely, independent of role permissions.
- PAMEngineers hold zero standing production access; it's requested, approved, time-boxed, and auto-expires.
- Risk mitigationInsider-trading-restricted (PIT) client data requires a logged case, not standing visibility.
- Security/UX trade-offHigh-value redemptions require step-up MFA; low-value ones don't — a deliberate decision, not an oversight.
- AuditabilityEvery decision, allowed or denied, is logged with the rule and reason that produced it.
- ExplainabilityDecisions are never a black box — each one names the exact rule and the plain-language reason behind it.