Stop asking your IGA team. Start asking your data.
TL;DR: Every CISO has asked "Who has admin access to production?" and waited days for the answer. IQL lets you type that question in plain English, get deterministic SQL, and see results in seconds. Not a chatbot. Not an LLM guess. Same question plus same data equals same answer, every time. The query itself is logged as audit evidence.
The question that takes three days
I spent years building identity governance products. In every organization I touched, the same scene played out: a CISO or auditor asks a straightforward question — "Who has admin access to production?" — and the answer takes days.
Someone opens a ticket. An IGA analyst writes a report. They export data from the access management system, cross-reference it against HR feeds, reconcile it with a spreadsheet someone maintains by hand because the connector never worked right. Three days later, a CSV lands in the CISO's inbox. By then, the data might already be stale.
This is not a tooling problem. It is a translation problem. The CISO knows exactly what they want. The data exists. But there is no path from the question to the answer without a human translator in the middle.
What IQL actually does
IQL — Identity Query Language — is the natural-language query layer inside SidantiX. You type a question in plain English. IQL translates it into SQL against the governance data model. The SQL executes. You get results.
I should be honest: natural-language-to-SQL is not a new idea. Plenty of vendors have shipped NL-to-SQL interfaces. What most of them do not ship is determinism. Their NL layer is an LLM that generates a plausible query — sometimes right, sometimes wrong, sometimes different each time you ask. That is fine for ad-hoc data exploration. It is not fine for governance.
IQL's translation targets a fixed, well-defined governance data model. The same question against the same data produces the same SQL and the same results. Every time. The generated SQL is visible, inspectable, and replayable. No black box.
Here is what the flow looks like:
You type: "Which service accounts haven't rotated credentials in 90 days?"
IQL generates: A SQL query against your credential-rotation and service-account tables with a date filter.
You see: The SQL (so you can verify it does what you meant), then the result set — service accounts, last rotation date, owning team.
More examples, all things I have seen take a week in real enterprises:
- "Show me all access grants that bypassed SoD policy"
- "Who approved the last 10 privilege escalations?"
- "List all AI agents with write access to PII stores"
- "Which contractors still have active accounts after their end date?"
Why determinism matters more than intelligence
The market wants to sell you intelligence. I want to sell you reproducibility.
If you run a compliance query on Monday and an auditor runs the same query on Wednesday against the same data, and the results differ — you do not have a governance tool. You have a suggestion engine. Suggestions do not survive audit. They do not hold up in a regulatory filing. They do not give your CISO the confidence to sign a control attestation.
Every IQL query produces three things:
- The generated SQL (inspectable, replayable)
- The result set (timestamped, exportable)
- A query receipt — who asked, when, what SQL ran, what came back
That receipt is audit evidence. Not a chat transcript. Not a screenshot of a conversation with a bot. A deterministic record that says: this person asked this question, the system ran this exact SQL, and here is what it returned.
What IQL does not do
I would rather you know the limits before you evaluate us than discover them during a proof-of-concept.
IQL does not understand arbitrary freeform questions about topics outside the governance data model. If you ask it about the weather, it will not help you. If you ask it a question that requires joining data SidantiX does not have — say, correlating access patterns with network traffic logs — it will tell you it cannot answer, not hallucinate one.
The NL-to-SQL translation is bounded by the schema. That is a feature, not a limitation. Bounded means predictable. Predictable means auditable. If you want an open-ended AI assistant, there are many on the market. If you want governance answers you can stake your audit on, that requires a narrower, more honest tool.
The shift
For two decades, the operating model has been: business asks a question, IGA team translates it into a report, answer comes back days later. That model survived when access reviews happened quarterly. It does not survive when AI agents are making access decisions continuously, when service accounts outnumber humans 10-to-1, and when your auditor wants to know what happened at 2:47 AM last Tuesday.
The shift is straightforward: stop routing every governance question through a human translator. Let the people who have the questions ask the data directly.
Your IGA team does not disappear. They build the governance model, maintain the connectors, define the policies. But they stop being the bottleneck between a question and an answer. They move from report writers to governance architects. That is a better use of their expertise, and they will tell you the same thing if you ask them.
Try it
IQL ships with every SidantiX deployment. No add-on license. No "enterprise tier only."
Type a question. Read the SQL it generates. Decide for yourself whether you trust the answer.
See IQL in action: start a Self Experience in your browser, or begin a 30-day free trial with your own tenant. Questions? Talk to the founder directly.