Someone left on Friday. Payroll still lets them in. So does the VPN.

Nothing passes until a person arms it.

A Nessort product, in research and development.

T minus 1

Read: go
Plan: go
Check: go
Person: waiting

This button is a demonstration. It changes only this page.

Ordivor is a console for identity changes. It reads every system that decides who has access, plans each change down to the person, has the plan checked, and waits for you.

Talk to Nessort

In our lab, three people have left.

The lab is a made-up company of forty people. HR has marked three of them as gone. The staff directory still lists them in four groups.

The console recordings on this page and in the film are the real Ordivor console, in our lab with made-up people.

People HR marks as gone, and the staff groups that still list them (the lab, made-up people)
Person	Still in
tomas.mansour	Finance
dina.moberg	Engineering
omar.vogel	Sales, Support

Four doors stay open.

One week, one control room.

Three minutes, narrated, with captions and a transcript. Illustrated with AI; the screens on the wall are the real Ordivor console, recorded in our lab with made-up people.

Read the transcript

[Office floor at night.] Friday, someone leaves the company. HR closes the record, yet payroll, the VPN and three forgotten groups still let him back in.
[Control room.] Ordivor asks one live question across HR, the identity provider and apps, exports the answer, storing nothing: who has access to what.
[Corridor of doors.] One place creates, updates, disables or enables accounts and groups, deriving titles and usernames from HR, instead of each system alone.
[Control room.] Every change starts as a plan, each person shown before and after. Two deliberate presses arm it, so nothing happens by mistake.
[Corridor of doors.] Just before each change, Ordivor reads the target again; if anything has moved, it stops, so nothing is ever applied on stale data.
[Boardroom.] A business owner asks in plain words, and a compiler writes the plan. The AI agent only suggests; control stays with a person.
[Policy library.] A second, independent AI checks each plan against written policy and holds anything risky, with its reason: segregation of duties before the change.
[Office lobby on Monday.] Monday, someone changes team. Scheduled syncs move them within a per-run limit, hold rather than guess, flag unjustified accounts.
[Team floor.] Leftover access is cleaned up continuously, never unsupervised. Temporary access and leavers end on schedule; nothing is forgotten.
[Loading dock.] Wednesday brings a system with no connector. An AI designer reads its API, writes one, proves it on test data; a person approves.
[Drafting studio.] A first, small version of this studio is already built, so no vendor holds you back. Connectors are signed data, not executable code.
[Server hall.] They install and upgrade like packages, a supply chain you can trust. Rule changes pass development and preview before production, each stage armed.
[Skybridge between towers.] Thursday, a partner needs some of these people. Organisations pair by safety number, offering only what both approve, signed and encrypted.
[Archive entrance.] Partly: pairing and offering are built; reading a partner's people is not. Then the auditor finds every step in a hash chain.
[Audit archive.] A gap or an edit would show; every attribute has lineage, drift and one proven writer. Evidence, ready for any audit or regulator.
[Credential vault.] Values stay masked, owners see counts only, credentials sit in a vault no agent sees, so nothing personal leaks to the AI.
[Row of glass cells.] Delivery is one binary and Postgres, built to run as a cell of its own for each customer: full isolation, low running cost.
[Control room.] In one sentence: Ordivor is the control room for every access change in the organisation. It reads everything live, plans every change precisely,
[Control room.] has it checked by an independent AI and by policy, and nothing passes until a person arms it, with evidence of every step.
[Control room wall at sunrise.] Ordivor, a Nessort product, in research and development. Talk to Nessort.

Every station can say go. Only a person can say launch.

T minus 4, Read. First, it looks.

Ordivor reads each connected system live, the moment you ask: your HR system, your identity provider, your apps. Each read is fresh.

Recording of the Ordivor console in the lab. A read of HR for people marked inactive is typed and run; the answer reads "3 records, read live, not stored" and lists tomas.mansour in Finance, dina.moberg in Engineering and omar.vogel in Sales and Support.

T minus 3, Plan. Say what should change.

Type it as one line. Ordivor answers with a plan: every person it would touch, every value before and after.

Recording of the Ordivor console in the lab. The line as sent takes the people who left out of the Support group on the staff directory; under it, Ordivor's plan, "1 change to @staff.group.members": the line explained in words, and the one change, omar.vogel removed from Support, member true to false.

T minus 2, Check. Then a second AI checks it.

The checker is separate from the agent that helped you write the plan. It reads the plan against your company's written policy, and when it holds a plan back it cites the clause or the number.

T minus 1, Arm. Then it waits for you.

A person arms the plan, then confirms it: two deliberate presses, and a double-click does not count. Left armed for twelve seconds, it disarms itself.

The Arm button at the top of this page works the same way.

Recording of the same plan in the Ordivor console. The checker, a second and separate pass, notes that the plan removes one inactive person from Support and that the other two are not members. A first press on Apply arms it, red, with the line "applies to a real system"; a second press confirms, and the plan reads Applied.

One AI helps you write it. Another checks it. A person decides.

T minus 0, Confirm. The second press. Now it moves.

Ordivor applies the plan exactly as it was checked. Just before each change it reads the target again, and stops if anything moved since the plan.

T plus 1, Run. Some changes keep running.

Commit a sync and Ordivor runs it on its own clock, inside the limits a person set. When a run would change more than it should, it holds for a person instead of guessing.

Recording of the clock's page in the Ordivor console: a sync from HR to the staff directory, every hour, with its limit of 50 changes a run and its last run.

T plus 2, Prove. Every step is on the record.

Each plan, check, arm and change lands in an append-only log, each entry chained to the one before, so a gap or an edit shows. People's data appears masked: a sample keeps only the shape of each value.

Recording of the Ordivor audit log in the lab: the log reads "chain verified"; "apply" is typed into its filter, and the four applies of the leaver plans sit together.

Meets systems it has never seen.

Connectors are signed descriptions, not code. For a system Ordivor doesn't know, its designer agent reads the system's API, writes the connector and proves it on test data. It only reads; the write lines it offers are yours to run. A person approves the connector before it is installed.

Recording of the connector designer's work on a lab system: what the agent was asked, the API paths it read, a draft that read 5 groups and 40 users, and the write lines it offers, each marked "not run".

Shares people only when both sides say yes.

Organisations that work together can share people over the Ordivor Network. Every request is signed. Sharing starts once both admins have read the same safety number to each other on a call, and each side chooses exactly who it shares.

Your Ordivor

Their Ordivor