Stop maintaining IAM governance in spreadsheets.

IAM governance shouldn’t take six months and a consulting firm.

Customers buy SailPoint, Saviynt, Okta IG, or Entra ID Governance — then fall behind the rollout because no single tool tracks their environment, their vendor’s prescribed methodology, and their compliance obligations in one place. Mid-market teams get stuck in between: too small for a six-figure rollout, too serious for spreadsheets, too busy to transcribe every vendor policy by hand.

Apex Steward is the in-between. It reads your existing documents, extracts the IAM structure already buried in them, measures where you stand, and turns a slide-deck commitment into a tracked, measured, evidence-producing program.

Three people who live in different parts of the product.

The IAM Program Managerowns the day-to-day — living in the implementation plan and the maturity assessments. The Security & Compliance Owner lives on the compliance dashboard and exports the executive report for auditors. The Implementation Consultant— internal or external — runs many client workspaces from one account as a shared source of truth, uploading vendor docs and reviewing conflict analysis across engagements.

The common thread: mid-market organizations, roughly 250 to 2,500 employees, that need a real governance practice without nine months or a six-figure budget to get there.

Extraction finds the plan. Conflict analysis tells you where you diverge.

Most IAM governance tools start with a blank table. Apex Steward starts with your vendor’s deployment guide. Upload a PDF or DOCX; Voyage AI embeddings index every section and Anthropic Claude extracts the vendor’s prescribed phase/step plan — with page citations and verbatim quotes.

Then comes the part the guide calls “the AI feature that makes Apex Steward actually intelligent.” Conflict analysis compares your intake, maturity, and plan against that prescribed methodology and returns 4–10 severity-coded divergences — critical, warning, or info — each citing the exact user-side field and the vendor-side page.

Bring a vendor deployment guide and watch real divergences surface in under a minute. Every claim traces back to its source; nothing is speculative.

A six-level model across four dimensions.

Apex Steward scores your IAM maturity on a six-level scale — 0 Non-existent through 5 Optimised — across four dimensions: Lifecycle Events, Application Onboarding, Access Request Process, and Access Reviews & Certifications.

Two paths fit two moods: a quick assessment returns a single overall score in under a minute, while a detailed per-dimension assessment feeds the compliance evidence engine. Every assessment is saved with a timestamp and its taker, and a history chart tracks progression over time — so the output is a live picture, not a static report.

One click to a board- and auditor-ready PDF.

When the CISO, the board, the SOC 2 auditor, or a parent company asks for the state of the program, Apex Steward produces it in one click. The report opens with an executive summary and the current maturity scorecard with trend, then ranks critical gaps by severity, lays out a 90/180/360-day roadmap, and calls out risks.

Every claim carries a footnoted citation — a vendor doc page, a plan step key, or a compliance subcategory id. Each report snapshots its inputs and is versioned per workspace, so re-rendering an old version reproduces exactly what was true then.

A chat layer that proposes — never silently acts.

Steward answers IAM and implementation questions about your workspace, grounded in the docs you’ve uploaded. When you tell it a reality has changed (“they’re on Oracle, not Workday”) or hit a roadblock (“the connector won’t authenticate”), it turns that into a structured accept/reject proposal.

It never mutates the live plan on its own. An admin applies the change, and the action is audit-logged — who asked, who committed. Proposes, then a human approves: the same principle that governs AI role-rule drafting.

Production-grade, not vibe-coded.

Apex Steward runs on TypeScript across the stack — React 18 with Vite on the front end, Node.js 20 with Express and Zod validation on the API, and Prisma over a tenant-isolated database. Production runs on AWS RDS PostgreSQL (the same Prisma schema serves SQLite in dev), deployed on AWS Elastic Beanstalk with end-to-end TLS and secrets in AWS SSM Parameter Store. The AI pipeline pairs Voyage AI embeddings with Anthropic Claude Sonnet 4.6 for extraction and reasoning.

It’s the kind of stack that scales without a rewrite and the kind of operational posture that survives a security review.

What buyers actually ask about.

Multi-tenant isolation at the database layer. JWT auth with HTTP-only, Secure-flagged cookies and email verification. End-to-end TLS from the browser to the application origin. Secrets stored in AWS Systems Manager Parameter Store.

Every AI call is audit-logged with its model, token counts, and estimated cost, and per-user daily limits keep usage bounded. A Context Confidence banner on every output states, in plain language, how complete the picture is — honesty as a default, not a disclaimer. SOC 2 Type II attestation is on the roadmap, not yet attained; reach out to discuss timing if certification is a hard prerequisite.