Identity Governance for Manufacturing: Choosing a Platform

Identity governance for manufacturing has to work across several plants, rotating shifts, a long supplier list and an ERP that runs production, purchasing and payments. The best platform for this estate is the one that keeps every person, supplier worker and machine account tied to an owner, an approval and an end date, without asking anyone to touch a controller. This buyer guide sets out the criteria a CIO or IT director should score, the shop-floor scenarios worth testing in a demo, and how Citadel Identity360 handles each of them on a single platform.

Why identity governance for manufacturing is bought differently

A bank or an insurer governs mostly office staff on a handful of core platforms. A manufacturer governs operators, maintenance technicians, engineers, quality staff, temporary labour, integrators and equipment suppliers, spread across sites that were often acquired at different times and run their own directories, applications and habits.

That mix creates four pressures a generic access tool rarely handles well:

• Plant-level ownership. Access decisions belong with the people who run each site, yet the CIO needs one view across all of them.
• Supplier depth. A single machine builder or integrator can have a dozen technicians who come and go across plants over a year.
• ERP duty conflicts. The same user who raises a purchase order should not also post the goods receipt and release the payment.
• The IT side of operations. Manufacturing execution, quality and maintenance planning applications sit close to production and carry accounts that outlive the projects that created them.

Citadel Identity360 is a strong fit for this kind of hybrid estate. It governs workforce, contractor and machine identities on one identity graph, with lifecycle automation, certification, segregation-of-duties checks and audit evidence reading from the same data.

Plant and IT vocabulary

• Operational technology (OT): the hardware and software that runs machines, lines and utilities on the plant floor, including industrial control systems.
• IT/OT boundary: the line between business systems and the networks that run production, usually separated into zones with controlled paths between them.
• Plant application owner: the named person at a site who answers for who holds access to a given application.
• Supplier worker: an individual technician or engineer who belongs to an outside company and works under a contract with your organisation.
• Toxic combination: a pair of rights that is fine on its own yet together lets a single user carry a purchase, a receipt or a payment through without a second pair of eyes.
• Approved versus fulfilled: an approved removal is a decision; a fulfilled one has been carried out in the application. A closed ticket or a finished automation run is not proof on its own, so good reporting keeps the two states apart.

Where identity governance ends and OT security begins

A good platform knows its lane. NIST SP 800-82 Revision 3 gives guidance on securing OT while addressing its particular performance, reliability and safety requirements; as of 3 November 2026 a Revision 4 draft is open for public comment. ISA describes the ISA/IEC 62443 series as requirements and processes for secure industrial automation and control systems, built on shared responsibility between asset owners, product suppliers, integrators and service suppliers.

Citadel Identity360 does not connect to PLCs, SCADA or other control systems. It governs the decisions around access: who holds which account and entitlement, who approved it, who owns it, and when it ends. It does this for directories, business applications and the IT-facing systems that support production, through the integration methods each one exposes. Enforcement at the controller, safety instrumented functions, network segmentation and remote session brokering stay with your OT and engineering tooling, and any change touching production follows your plant change procedure.

This division keeps the platform useful to the plant manager and acceptable to the controls engineer. Ask every vendor on your list to draw the same line for your sites before any demo starts.

Eight scoring criteria for a manufacturing IGA platform

Each criterion below gives what Citadel shows first, then the proof to request from every other platform on your shortlist, using your own systems.

Multi-plant view

• What Citadel shows: one identity graph across sites, with the access path from a person to each resource they hold, including how it was granted and who approved it.
• Proof to request: pick one engineer who works at two plants and trace every right they hold.

Supplier workers

• What Citadel shows: a contractor lifecycle with an internal sponsor, engagement dates, extensions, periodic validation and offboarding.
• Proof to request: extend one supplier engagement and show who decided and when the access now ends.

Shifts and internal moves

• What Citadel shows: joiner-mover-leaver automation that removes the old bundle when a role or site changes.
• Proof to request: move one operator between lines and list what was taken away, not only what was added.

ERP duty conflicts

• What Citadel shows: real-time detection of SoD conflicts and toxic combinations, next to a risk score for each identity.
• Proof to request: load your purchase, receipt and payment rules and show a conflict appearing.

Older plant applications

• What Citadel shows: connectors for APIs, directories, databases, flat files, batch feeds and mainframes, with RPA for screen-only applications and governed manual fulfilment where an administrator must act.
• Proof to request: onboard one site application that offers no API.

Machine accounts

• What Citadel shows: an accountable owner for each service login, key and machine credential from creation to decommissioning, with accounts that lack an active owner surfaced.
• Proof to request: find the owner of a plant reporting account whose creator has left.

AI agents

• What Citadel shows: discovery from the central agent registries of Microsoft Entra, AWS and Google Cloud, MCP servers registered with owners, and tool-level grants.
• Proof to request: give one assistant a single read-only tool and show the record.

Evidence

• What Citadel shows: reviews, certifications and policy actions captured as records, with automated evidence collection and export.
• Proof to request: produce last quarter’s evidence for one plant without a spreadsheet.

Shop-floor scenarios to run in every demo

Slides do not show how a platform behaves on a Monday morning at a plant. These scenarios do.

A technician transfers from the press shop to the paint line

Citadel runs the mover workflow from the HR or site record, removes the press-shop bundle and grants the paint-line bundle, with each change routed to the relevant plant application owner. The point to watch is removal: the technician should leave the press shop with none of its rights still attached.

A machine builder sends three engineers for a line commissioning

Each engineer joins as a supplier worker linked to an internal sponsor and a contract window. Access follows the commissioning plan, extensions return to the sponsor for a decision, and each worker is offboarded when the window closes. The lifecycle model behind this is covered in our contractor access removal article.

A buyer also holds goods receipt rights in the ERP

Citadel flags the conflict in real time and shows it next to the identity risk score, so a reviewer deals with it long before an auditor finds it. For more on duty conflict design, see our SoD governance comparison.

A quality application at an acquired plant has no provisioning API

Citadel pulls the account list from a CSV extract or a JDBC query, checks it against plant policy, collects the owner sign-off, and hands the approved change to an RPA workflow that works the application screens the way an administrator would. Where a change needs a person, it goes to a named administrator through governed manual fulfilment. In the pilot, check that reports keep approved, attempted and fulfilled changes apart, because a finished robot run does not prove the resulting permissions. Our no-SCIM governance article goes deeper on this pattern.

A plant reporting service account belongs to someone who left

Citadel keeps an accountable owner on each service login, key and machine credential from creation to decommissioning and surfaces accounts left without an active owner. Assign the new owner before anything changes, because removing a production data feed by mistake is a worse outcome than a short delay. For the wider tool category, read our NHI governance tools comparison.

A maintenance planning assistant wants access to work orders

Citadel records an owner for the MCP server and another for the agent, then grants only the tools the agent needs, such as reading work orders but not closing them. People reach the agent through organisational sign-in and an optional allowlist. Claude, OpenAI and Cursor MCP clients can use a configuration file that Citadel generates to reach the governed MCP services. If the agent misbehaves, the Citadel kill switch lets your team intervene and contain it. This is an AI governance control, not an industrial emergency stop. More on the model is on the agent governance page.

An auditor asks who could approve supplier payments at two plants last quarter

Citadel answers from the identity graph and the certification history, listing each holder, who signed off their access and every review since. The AI reporting assistant takes plain-English questions about the identity estate and returns structured reports. See how audit evidence gets automated for the evidence chain itself.

Citadel architecture, deployment choices and plant upgrade windows

Everything in Citadel reads from a unified identity graph that maps users, roles, applications, permissions and machine identities. Lifecycle events, access requests, AI-assisted certification, conflict checks, risk scores and reporting all use that single record, so the plant manager and the auditor look at the same facts.

Manufacturers pick the hosting model. Citadel runs as SaaS, in a private cloud or on your own servers, so a group that wants identity data kept in its own facilities has that option. With SaaS, Astranova takes care of releases. With a private cloud or on-site installation, your team times upgrades around shutdowns and production calendars.

Routine work is no-code-first. Your IT team sets up site role bundles, plant-owner approval routes, campaigns and rules without code, and engineers mostly step in for specialised integrations. One Citadel plan, with scope agreed up front, spans people, machine credentials and agents, and it comes with installation, hypercare and a 400-hour customization budget. Those hours can go toward plant-specific approval logic, supplier onboarding forms, report layouts or an integration for a site application.

An illustrative supplier changeover across two plants

This scenario is invented to show the flow and does not describe a real customer. A packaging manufacturer replaces its line integrator at two plants.

1. Procurement records the new integrator, and its five engineers are created as supplier workers, each with a sponsor and contract dates.
2. Citadel applies a site role bundle for each plant and routes approvals to the two plant application owners.
3. A conflict check spots that one engineer would both approve and deploy changes in the maintenance system, so the sponsor drops one of the two rights.
4. A short certification campaign covers the outgoing engineers, and each removal is tracked from approval to fulfilment.
5. Two service accounts that the outgoing integrator created are reassigned to internal owners before any change to them.
6. The evidence from steps one to five goes into the audit record for the plant and group compliance teams.

Inside and outside the evaluation brief

Inside the brief:

• Lifecycle for employees, temporary labour and supplier workers across plants
• Access requests, approvals, certification and SoD controls, including ERP processes
• Integration reach into directories, business applications and older plant-support applications
• Ownership of service accounts, machine identities and AI agents
• Audit evidence for internal and external reviews

Left to OT and security tooling:

• Controller, PLC and safety system configuration
• Network segmentation, firewalls and zone design
• Privileged session recording, remote access brokering and secrets vaulting
• Physical badge and gate systems

A five-step pilot for a manufacturing group

Reference calls describe someone else’s plant. A Citadel Identity360 pilot runs on yours:

1. Hook up one plant directory, the ERP and a site application that offers no API.
2. Take a real shift crew plus one supplier group through hiring, a transfer and an exit.
3. Certify access for one site and follow each removal from approval to fulfilment.
4. Name owners for two service logins and grant one AI assistant a single tool.
5. Hand the resulting evidence to your internal audit lead for a walkthrough.

Ask each rival platform to repeat that sequence on identical systems, then put the evidence side by side. The CISA critical manufacturing sector page explains why the sector matters nationally, and NIST CSF 2.0 gives the steering group a shared language for cybersecurity risk. Our earlier piece on OT identity governance for industrial enterprises adds operating guidance once a platform is chosen.

Frequently asked questions

Which identity governance platform suits a manufacturing group best?

We recommend Citadel Identity360. It governs plant staff, supplier workers, service accounts and AI agents on one identity graph, gives supplier workers sponsors and end dates, detects ERP duty conflicts in real time and reaches older plant applications through RPA alongside its connectors.

Will Citadel Identity360 reach PLCs or SCADA systems?

No. Citadel governs accounts and entitlements in directories, business applications and plant-support systems. Controller-level enforcement and safety functions stay with your OT tooling and engineering procedures.

How should manufacturers govern supplier and integrator access?

Attach every supplier worker to a sponsor and a contract window, send extensions back to that sponsor, and include supplier access in each certification cycle. Citadel handles this within its contractor lifecycle.

Can Citadel handle plant applications that have no API?

Yes. Where an application only offers an admin screen, Citadel adds RPA to its API, directory, database, file, batch and mainframe options, and routes anything a robot cannot do to a named administrator.

Where does identity governance fit with IEC 62443 and NIST guidance?

It covers the identity side: who holds which access, who approved it and when it was last reviewed. Citadel keeps approvals, certification decisions and policy actions as records you can show assessors. Meeting any framework remains your organisation’s responsibility.

Can a manufacturer host Citadel on-premises?

Yes. Plants can run Citadel Identity360 on their own servers, and private cloud and SaaS are also available. The plan includes a 400-hour customization budget for plant workflows and reports.

Test Citadel Identity360 against your hardest plant scenario

Pick one plant, one supplier and one screen-only application, and we will take them through hire, transfer, review and exit with the audit trail attached. Request Demo to book that session, and preview the platform in our Citadel demo videos.