Identity Holders
Personnel records (or Identity Holders) are the workforce roster for your compliance program: employees, contractors, interns, partner staff, and service identities, whether or not they ever log in to Openlane. Access reviews, offboarding checks, and training or policy attestations are all evaluated against this roster, so most programs maintain it deliberately rather than reconstructing it from HR exports at audit time.
The roster intentionally covers more than payroll. Agency contractors, short-tenure interns, partner staff with credentials, and service accounts all hold access that auditors expect you to govern, so they belong in scope regardless of who employs them. A field engineer who must attest to your acceptable use policy needs a roster record and a campaign target rather than a platform seat.
How Personnel Records Work
The roster can sync from an identity integration such as Google Workspace, Azure Entra ID, or Authentik. When you connect an identity provider, you can designate it as your primary directory: the authoritative source that populates most fields on the identity holder records it manages, keeping the roster in step with the directory itself. How synced accounts from multiple sources resolve into one record per person is covered in Directory Sync and Identity Resolution.
Every record classifies the working relationship and carries a status covering the lifecycle from onboarding through deactivation, with start and end dates that anchor tenure. Contractors can point at their agency through an employer entity, so third-party staff always trace back to the vendor relationship that brought them in.
Personnel records connect to the campaigns and assessments they respond to and the assets and platforms they own or access. For the complete field list, see the GraphQL object reference.
Working with Personnel
Build the Roster Once, Then Keep It Synced
Connect your identity provider and mark it as the primary directory so employee records stay current without manual upkeep. Then fill the gaps the directory cannot see: import contractors and partner staff via CSV, set their type and employer entity, and give each record start dates and an owner. The goal is a single roster where filtering on isActive answers "who works in the environment today" without caveats.
Run a Policy Attestation Campaign
The evidence value of a quarterly or annual attestation depends on the accuracy of its target list. Filter the roster to active personnel, create a policy attestation campaign with those records as targets, and launch. Openlane tracks completion per target, so you can resend to anyone incomplete and keep the completion metrics as evidence that the communication control operated during the period.
Produce Offboarding Evidence
When someone leaves, update their record rather than deleting it: set the end date, flip isActive to false, and move the status to Deactivated. The record and its history remain queryable, which is exactly what you need when an auditor samples terminated personnel. If you sync a primary directory, the synced directory accounts on each record let you verify that a departed person's upstream accounts were actually deactivated, not just that HR processed the exit.
FAQ
Do personnel need Openlane accounts?
No. Identity holders exist independently of Openlane logins, so your roster can cover everyone in scope without buying seats for people who never use the platform. When a person does have an Openlane account, the record links to that user, so their roster entry and platform identity stay connected.
What should happen to a record when someone leaves?
Update it, do not delete it. Set the end date, mark the record inactive, and set the status to Deactivated. Auditors routinely sample departed personnel to test offboarding controls, and a deleted record leaves you reconstructing history from email threads. A deactivated record with dates intact is the evidence.
How do directory sync and manually created records coexist?
The integration you designate as the primary directory is the authoritative source for the records it manages, and it populates most fields on those records. People your directory cannot see, such as agency contractors or partner staff, live alongside them as manually created or CSV-imported records. Filtering and campaigns treat both the same way, so a mixed roster still behaves as one roster.
Examples
- CSV
- GraphQL
- Go Client
- CLI
# Create
FullName,Email,IdentityHolderType,Department,Team,Title,Location,IsActive
Avery Jordan,[email protected],EMPLOYEE,Engineering,Platform,Senior Engineer,New York,true
Riley Chen,[email protected],CONTRACTOR,Security,GRC,Security Analyst,Remote,true
# Update
ID,Team,Title,IsActive,EndDate
IDH01J9ABCDEF1234567890XYZ,Security Operations,Security Engineer,true,
IDH01J9ABCDEFFFEDCBA098765,Security,GRC Contractor,false,2026-03-31T00:00:00Z
mutation {
createIdentityHolder(
input: {
fullName: "Avery Jordan"
identityHolderType: EMPLOYEE
department: "Engineering"
title: "Senior Engineer"
}
) {
identityHolder {
id
fullName
}
}
}
mutation {
updateIdentityHolder(
id: "IDH01J9ABCDEF1234567890XYZ"
input: {
team: "Security Operations"
title: "Security Engineer"
}
) {
identityHolder {
id
team
}
}
}
ctx := context.Background()
department := "Engineering"
title := "Senior Engineer"
_, err := client.CreateIdentityHolder(ctx, graphclient.CreateIdentityHolderInput{
FullName: "Avery Jordan",
Department: &department,
Title: &title,
})
if err != nil {
return err
}
team := "Security Operations"
_, err = client.UpdateIdentityHolder(ctx, "IDH01J9ABCDEF1234567890XYZ", graphclient.UpdateIdentityHolderInput{
Team: &team,
})
if err != nil {
return err
}
openlane identityHolder create \
--name "Avery Jordan" \
--email "[email protected]" \
--type EMPLOYEE \
--department "Engineering"
openlane identityHolder update \
--id "IDH01J9ABCDEF1234567890XYZ" \
--full-name "Avery Jordan" \
--environment "production"