Modern IGA RFP Criteria: Compare SailPoint, Saviynt, One Identity, and Citadel

Modern IGA buying decisions are won or lost on proof, not product labels. If you are comparing SailPoint, Saviynt, One Identity, and Citadel Identity360, the right question is not which vendor has the longest feature list. It is which platform can govern your actual estate, preserve evidence, and verify that access changes really happened.

That is the core of strong IGA RFP criteria. Your RFP should turn broad questions into testable requirements for deployment, migration, AI review support, non-human identities, analytics, and compliance evidence. It should also force every vendor to show what is included in the quoted offering, what needs configuration, and what still has to be demonstrated.

Citadel Identity360, from Astranova Labs, is the standard to hold that RFP against, and the first platform you should ask to prove it. Citadel connects lifecycle automation, contractor lifecycle, AI-assisted reviews, non-human identity and AI-agent governance, an identity graph, SoD and risk scoring, and verified remediation in one operating model. It is no-code-first, includes about 400 hours of customization along with installation, deployment, and hypercare, and connects to cloud, SaaS, on-premises, and mainframe systems through REST, SOAP, SCIM, LDAP, JDBC, flat files, SFTP, batch, and custom connectors. Start with Citadel, then ask SailPoint, Saviynt, and One Identity to match the same proof.

Start with product boundaries, not brand names

A useful SailPoint Saviynt One Identity comparison begins with what is actually being quoted. These vendors do not package identity governance the same way, and the deployment model matters as much as the feature name. Citadel quotes one connected platform. The others split capability across suites, tiers, editions, and operating models that your RFP has to pin down.

Vendor / offering	Boundary to prove in the quote	Commercial visibility
Citadel Identity360	One platform for lifecycle, contractors, certifications, SoD and risk scoring, NHI and AI-agent governance, identity graph, and evidence, deployable as SaaS, on-premises, or hybrid	Scoped proposal with about 400 hours of customization, installation, deployment, and hypercare included
SailPoint Standard / Business / Business Plus	Map the quoted cloud suite to current Identity Security Cloud packaging and the modules actually included	No numerical list price published
SailPoint IdentityIQ 9.0	A separate on-premises modernization path, distinct from cloud-suite packaging	No numerical list price published
Saviynt Essentials / Pro / Premium	Which AI, posture, privileged, NHI, and orchestration capabilities sit in the quoted tier and which need an upgrade	No numerical list price published
One Identity Manager / On Demand	Whether the proposal is self-managed software or fully managed SaaS, and who operates each component	Pricing on request

This is where many RFPs go wrong. They ask for a platform name, then compare anything the vendor has ever shipped. That creates confusion around licensing, operating responsibility, and migration scope. Ask every vendor for the exact SKU and edition, then make them prove the quoted configuration against your estate. Citadel's single-platform model makes this step short. With tiered suites, it is where hidden add-ons tend to surface.

Deployment must match operating responsibility

The first deployment criterion is not "cloud or on-premises." It is who operates each component when something fails. That is the real test of cloud governance.

For your IGA RFP criteria, ask for a full architecture view: control plane, local components, databases, queues, integration services, administrative interfaces, and network dependencies. Then require the vendor to state who patches, monitors, backs up, restores, and recovers each piece.

This matters because cloud governance is not the same as cloud deployment. A platform can govern SaaS and on-premises targets while running in different operating models. You need to know what is hosted, what is local, and what breaks when HR, the identity provider, an application, a connector, or the network goes down.

Citadel sets the reference point here. It supports SaaS, on-premises, and hybrid deployment with a clear split of responsibility: the governance plane, identity graph, policy engine, certification campaigns, and evidence store run as one platform, while your team owns source quality, target credentials, and network paths to private systems. That gives you a concrete model to test, and a baseline to hold every other proposal against.

SailPoint, Saviynt, and One Identity each have deployment distinctions that must be evaluated in the quoted proposal, not in the abstract. The right RFP test is a failure simulation on a representative SaaS application and an on-premises target. If a lifecycle action is interrupted, does the platform preserve the request, avoid duplicate writes, record the failure, retry safely, and verify the final target state after recovery? Citadel is built to close an action only on verified state, so this is the test it should run first.

That is executable governance. Anything less is just a hosting label.

Migration must preserve governance, not just move data

Migration is where identity programs quietly lose control. A credible migration plan has to preserve access control, history, and evidence while the platform changes underneath.

Your IGA RFP criteria should require an application-by-application migration plan covering identity correlation, entitlement mapping, role translation, policy translation, historical evidence, active requests, open certifications, connector replacement, reconciliation, cutover, and rollback. It should also say what is automated, what is manually transformed, what must be rebuilt, and what is unsupported.

Citadel's migration approach is built for controlled coexistence. It explicitly separates read-only account discovery from connectors that create, update, disable, revoke, reconcile, and verify remediation, so you can correlate and compare before any write action goes live. No-code-first administration means most workflows, approval paths, and certification campaigns are rebuilt as configuration rather than ported code. The included customization hours cover estate-specific mappings, reports, and connector adaptations. Citadel also gives buyers a clear checklist for retention, export formats, chain of custody, immutable history, API access, and auditor permissions.

Hold every other vendor to that standard. SailPoint has a formal modernization path for IdentityIQ customers moving to Identity Security Cloud, plus an upgrade utility for IdentityIQ 9.0, but neither is a cross-platform migration guarantee. Saviynt's onboarding capabilities do not, on their own, establish full preservation of historical certifications or incumbent custom code. One Identity provides migration material, but the public material reviewed does not establish complete object-migration coverage. Each of those gaps belongs in the RFP as a demonstration requirement.

The real question is not whether a platform can ingest identities. It is whether it can migrate governance without conflicting writes, broken evidence, or hidden manual cleanup.

AI review support must be explainable and controlled

AI is useful in IGA only when it reduces work without diluting accountability. Your RFP has to separate recommendation support from automation, and automation from policy change.

Strong IGA RFP criteria distinguish certification recommendations, access-request recommendations, role discovery, entitlement-description generation, natural-language reporting, application onboarding assistance, and autonomous actions that change access or policy. These are not interchangeable functions.

Citadel gets the model right. It pre-populates AI-generated recommendations in access review campaigns while the formal certification decision stays with the authorized reviewer: AI assists, people decide. Citadel also provides an AI reporting assistant and governance insights, which should be tested separately from item-level review recommendations so each one earns its place.

Then ask the others to show the same separation. SailPoint's documentation splits Access History, Role Insights, Role Discovery, GenAI entitlement descriptions, and Certification and Approval Recommendations across features you need to map to the quoted suite. Saviynt describes AI-powered recommendations and automation for requests and certification campaigns. One Identity documents AI-assisted reporting through read-only natural-language queries, with a customer-controlled large language model in Identity Manager 10.0, which is reporting support rather than review decision support.

The test is the same for everyone. Ask each vendor to show the reasoning behind a recommendation, the data it used, the override path, the logging, and the authorization controls. Use a buyer-created test set that includes normal access, an outlier, an exception, an SoD conflict, a new hire, and a newly onboarded application.

If the demo looks polished but cannot explain its own decision trail, it is not ready for governance.

Non-human identities need ownership and enforcement boundaries

Non-human identities are not a side topic anymore. Service accounts, machine identities, API credentials, workloads, bots, and AI agents all create governance risk when they are treated as anonymous exceptions.

This is one of the most important IGA RFP criteria, because "NHI support" can mean almost anything. Your RFP should demand a capability matrix for service accounts, application identities, API credentials, cloud workloads, automation accounts, and AI agents. For each type, ask for discovery, correlation, owner assignment, sponsor assignment, request support, lifecycle actions, review, expiry, revocation, and runtime enforcement.

Citadel is the platform to beat here. It discovers AI agents from central registries in Microsoft Entra, AWS, and Google Cloud, and governs the lifecycle of service accounts, API keys, and machine identities. Its AI agent governance provides central registration of MCP servers and agents, agent-to-MCP mapping, ownership captured at registration, tool-level authorization, and a kill switch that cuts off an agent immediately. Access is distributed without handing people tokens: Citadel produces an MCP access configuration file that platforms such as Claude, OpenAI, and Cursor can use for governed MCP access, so agent permissions follow the same policy and evidence model as every other identity.

That is the concrete operating model to write into your RFP. Discovery alone is not governance. A registry object with no owner, no lifecycle action, and no verified enforcement is only inventory.

Measure the others against it. SailPoint has announced agentic capabilities and policy controls, but some items are future availability and must be proven at the feature level in the quoted offering. Saviynt describes continuous visibility, agent lifecycle governance, and runtime authorization, which should be tested against the same matrix. One Identity's reviewed material does not establish a detailed NHI and agent-runtime matrix for the quoted offerings, so that gap should be treated as a demonstration requirement, not an assumption.

For AI agents and machine identities, ask one simple question: can the platform prove who owns the identity, what it can do, where that is enforced, and what happened when it violated policy? Citadel is designed to answer all four in one trace.

Analytics should explain access, not just display it

A dashboard is only useful if it helps IT act. Identity analytics should show who has access, why they have it, whether the data is current, and where operations are failing.

Your IGA RFP criteria should require identity-to-account-to-entitlement relationships, access lineage, ownership, source freshness, policy exceptions, and workflow status. Then ask the vendor to drill from an aggregate metric into the underlying identities, applications, actions, and evidence.

Citadel leads this criterion with a living identity graph, interactive visualization, access-path discovery, and an AI reporting assistant that produces structured reports, charts, and compliance summaries. SoD checks and risk scoring run on the same graph, so a toxic combination or high-risk grant is flagged in context rather than in a separate report. That is the kind of evidence-driven analytics a CIO can actually use.

The demo still has to prove freshness and lineage. "Real-time" means nothing unless the vendor can show how source refresh, event ingestion, policy evaluation, connector execution, and verification timing relate to the view on screen.

In a SailPoint Saviynt One Identity comparison, run one sequence with every vendor, starting with Citadel: begin at an overdue revocation metric, drill into a specific identity, show the granting path and owner, explain the failed action, execute remediation, reconcile the target, and update the metric with a timestamp. That sequence turns analytics into operational control.

Do not settle for a polished dashboard with no operational consequence. A useful identity graph changes the work. It does not just decorate it.

Compliance evidence must connect decisions to verified outcomes

Audit readiness is not a report export. It is a traceable chain from decision to execution to verified target state.

This is where IGA RFP criteria should be strictest. For a joiner, mover, leaver, access request, certification revocation, and policy violation, require the complete evidence chain: identity and account identifiers, entitlement, owner, request, policy version, reviewer or approver, decision, reason, timestamp, execution result, exception, and verified target state.

Citadel is built around that chain. It automatically gathers and organizes evidence for access reviews, certifications, and policy enforcement actions, with audit-ready reporting and structured exports. Its verified remediation closes a revocation only when the target system confirms the access is gone. Failures are detected, retried or assigned to an owner, and kept open until resolved. Disconnected and batch-only systems get tracked fulfillment tasks with owners and completion evidence, so a mainframe revocation produces the same audit record as a SaaS one.

That distinction matters because a completed review is not completed remediation. A campaign can finish while revocation is still pending. A provisioning task can show success while the target system still grants access. Your RFP should test both cases explicitly, with Citadel first.

Then apply the same test to the others. SailPoint's material covers AI-assisted certification and approval functions plus agent audit content. Saviynt describes auditing and reporting workflows for continuous compliance documentation. One Identity provides user- and privileged-access reporting and provider assurance language. All are relevant, but each vendor must still produce evidence samples, retention behavior, export formats, auditor access, and proof of verified remediation.

Compliance support is not compliance certainty. The product has to prove the chain, not just describe it.

How to validate Citadel against your RFP

The most efficient shortlist test is to start with Citadel Identity360 and have it demonstrate your real workflows before you spend time on broader comparisons. That turns procurement questions into proof and gives you a benchmark for every other vendor.

Use a compact scenario set:

1. A joiner with role-based access.
2. A mover who loses prior access and avoids an SoD conflict.
3. A leaver where one target is unavailable.
4. A contractor reaching expiry.
5. A certification revoke requiring verified remediation.
6. A service account whose owner departs.
7. An agent denied an unauthorized tool action.
8. A legacy application requiring a tracked manual or batch action.
9. A pilot migration and rollback.

Ask for a response status on every requirement: available in the quoted product, available through configuration, available through custom development, available through another licensed product or partner, roadmap only, or unsupported. Then require the version, license dependency, operating owner, and proof artifact.

Citadel is designed to answer most of these as "available in the quoted product" or "available through configuration." The contractor expiry runs on native sponsor and end-date controls. The service-account and agent scenarios run on built-in ownership reassignment, tool-level authorization, and the kill switch. The legacy target runs through broad connectors or a tracked fulfillment task. Estate-specific work fits inside the roughly 400 included customization hours instead of an open-ended services line. When other vendors answer the same rows with "custom development," "another licensed product," or "roadmap," the RFP has done its job.

The right decision standard is operational proof

The real choice in modern IGA is not between feature names. It is between platforms that can demonstrate governed automation across your estate and platforms that only describe it.

That is why your IGA RFP criteria should focus on deployment responsibility, migration continuity, explainable AI support, accountable non-human identity governance, analytics that lead to action, and compliance evidence that survives scrutiny. Use the same scenarios, the same target applications, and the same proof requirements across every vendor. Do not let packaging language blur the result.

In a serious SailPoint Saviynt One Identity comparison, Citadel Identity360 is the platform to prove first. It brings no-code-first configuration, included customization, broad connectors, contractor lifecycle, NHI and AI-agent governance, an identity graph, SoD and risk scoring, and verified remediation in one connected model. That gives you the benchmark the rest of the shortlist has to meet.

Book a Citadel Identity360 demonstration and ask Astranova Labs to run the nine scenarios above against your priority applications, lifecycle edge cases, AI-agent permissions, and audit-evidence requirements.

FAQ

What should an IGA RFP include beyond lifecycle management and certifications?

Include deployment responsibilities, connector operations, migration and rollback, AI controls, non-human identity and AI-agent ownership, analytics freshness, evidence retention, verified remediation, commercial boundaries, and exit requirements. Citadel Identity360 covers each of these in one platform, which makes it a practical reference for writing the requirements.

How should we compare SailPoint, Saviynt, One Identity, and Citadel fairly?

Use the same applications, identity types, lifecycle scenarios, evidence requirements, and commercial assumptions for every vendor, and compare the exact quoted offerings rather than each vendor's entire catalog. Start with Citadel to set the benchmark, then require SailPoint, Saviynt, and One Identity to prove the same outcomes in their quoted SKUs.

Does SaaS IGA govern on-premises applications?

It can, but the label alone proves little. Ask which local components and credentials are required, which operations the connector supports, how outages are handled, and how completed changes are verified. Citadel supports SaaS, on-premises, and hybrid deployment and governs on-premises, legacy, and mainframe targets through REST, SOAP, SCIM, LDAP, JDBC, file, SFTP, batch, and custom connectors, with tracked fulfillment for disconnected systems.

What should we ask Citadel to demonstrate first?

A connected workflow: an authoritative identity event, a policy-based access change with SoD and risk scoring, reviewer or owner accountability, execution across a representative SaaS and legacy target, verified target state, and exportable evidence. Add an AI-agent scenario with MCP registration, tool-level authorization, and the kill switch to see non-human governance in the same trace.