# Opal integrations

> Connect Opal to your security stack, ITSM tools, and HR systems to clean up access reviews, provisioning, and least-privilege enforcement at scale.

**Canonical page:** https://tray.ai/connectors/opal-integrations/
**Categories:** Security and compliance, General automation services
**Documentation:** https://tray.ai/documentation/connectors/service/opal

## Overview

Opal is a modern access control platform that lets teams manage permissions, run access reviews, and enforce least-privilege policies across cloud resources and SaaS apps. Integrating Opal with the rest of your tech stack cuts out manual provisioning bottlenecks and makes sure identity events — new hires, role changes, offboarding — trigger the right access actions without anyone having to babysit them. With tray.ai, you can connect Opal to HR systems, ticketing platforms, SIEM tools, and directory services to build end-to-end identity lifecycle workflows without writing custom glue code.

## Use cases

### Automated Employee Onboarding Access Provisioning

When a new employee record is created in your HRIS — Workday, BambooHR, or similar — Opal automatically provisions the right resource groups and permission sets based on department, role, and location. No more back-and-forth between HR, IT, and engineering while someone waits to do their actual job.

- New hires get correct access on day one without manual IT tickets
- Role-based access policies in Opal apply consistently across every new employee
- Audit trail is maintained automatically for compliance and SOC 2 reporting

### Offboarding and Access Revocation Workflows

When a termination event fires in your HRIS or identity provider, Opal revokes access immediately or on a schedule. Slack and email notifications go out to IT and security, and the revocation event gets logged to your SIEM or ticketing system before anyone has to ask.

- Eliminate orphaned accounts and lingering permissions after employee departures
- Shrink the window of risk from hours or days to minutes
- Security teams stay informed of access changes without chasing down confirmations

### Periodic Access Review Automation

Schedule recurring access review campaigns in Opal and automatically notify resource owners and managers via Slack or email with direct review links. Review outcomes sync back to Jira or ServiceNow, closing associated tickets and updating CMDB records with current permission states.

- Replace manual spreadsheet-based access reviews with automated workflows
- Improve reviewer response rates with contextual Slack and email nudges
- Keep compliance posture documented with consistent review cycles

### Just-in-Time Access Request and Approval Routing

Opal access requests get routed through your existing approval workflows in Jira Service Management, PagerDuty, or similar tools based on resource sensitivity, requester role, or time of day. Access is granted temporarily on approval and revoked automatically when the window expires.

- Enforce least-privilege by default with time-bounded elevated access grants
- Plug into existing approval chains rather than building a separate process
- Automate low-risk access approvals entirely to get engineering off the critical path

### Security Incident Access Lockdown

When a security alert fires in your SIEM, EDR, or threat detection platform, Opal's API suspends access for flagged users or resources while an investigation runs. Incident context goes to your incident management platform and the security team gets notified through existing channels — no manual steps required.

- Contain potential breaches by revoking access in seconds, not hours
- Tie access lockdown directly into your incident response runbooks
- Restore access automatically when the incident is resolved and risk is cleared

### Cross-System Permission Drift Detection and Remediation

Permissions granted in Opal get continuously compared against source-of-truth role definitions in your HRIS or identity provider. When drift shows up — say, a user still has access after a role change — a remediation workflow updates Opal and alerts the resource owner before it becomes an audit finding.

- Catch and fix permission drift before audits surface it
- Keep HR role data and actual system access in sync
- Cut manual reconciliation effort for compliance and security teams

### Access Analytics and Reporting Pipeline

Opal access events, review outcomes, and provisioning logs export on a schedule into your data warehouse or BI platform — Snowflake, Looker, or similar. The result is dashboards that actually show you over-privileged users, review completion rates, and time-to-revoke metrics for executive and compliance reporting.

- Give security and compliance teams real-time visibility into access posture
- Feed access data into existing security data lakes without custom ETL scripts
- Support audit evidence collection with automated, timestamped data exports

## Templates

### HRIS New Hire to Opal Access Provisioning

Automatically provisions the correct Opal resource groups and permission sets when a new employee is created in Workday or BambooHR, based on mapped role and department attributes.

Connectors used: Opal, Workday REST, BambooHR, Slack

### Employee Offboarding Access Revocation

Revokes all Opal access when an employee termination is detected in the HRIS, notifies security and IT teams, and logs the event to the SIEM and ticketing system.

Connectors used: Opal, Workday REST, ServiceNow, Slack, Splunk HTTP Event Collector

### Opal Access Review Reminder and Escalation

Sends automated Slack and email reminders to pending access reviewers in Opal and escalates to their manager if reviews aren't completed before the deadline.

Connectors used: Opal, Slack, Gmail, Workday REST

### SIEM Alert to Opal Emergency Access Suspension

Automatically suspends a user's Opal access when a high-severity security alert fires in Splunk or Datadog, and creates an incident ticket in PagerDuty.

Connectors used: Opal, Splunk HTTP Event Collector, PagerDuty, Slack

### Opal Access Event Export to Snowflake Data Warehouse

Exports Opal access provisioning, revocation, and review events to Snowflake on a schedule to power compliance dashboards and security analytics.

Connectors used: Opal, Snowflake, Slack

### Role Change Permission Update in Opal

Detects role or department changes in the HRIS and automatically updates the user's Opal access to match the new role's permission profile, removing old access and granting new access in a single workflow.

Connectors used: Opal, BambooHR, Jira, Slack

## Challenges Tray.ai solves

### Manual Access Provisioning Creates Security and Productivity Gaps

IT and security teams manually processing access requests through tickets frustrate employees waiting for day-one access and produce inconsistent provisioning that generates audit findings. Teams spend hours per week on access tickets instead of work that actually moves the needle.

**How Tray.ai helps:** tray.ai connects your HRIS and directory to Opal so provisioning triggers automatically on HR events. Role-to-resource mappings defined once in the workflow apply consistently every time, removing humans from the critical path of routine access grants.

### Disconnected Tools Leave Access Review Outcomes Siloed

Opal access review results often don't automatically update downstream systems like ticketing platforms, CMDBs, or data warehouses. Security teams manually export results and update records, which creates lag and leaves systems out of sync.

**How Tray.ai helps:** tray.ai workflows listen for completed review events from Opal and automatically push outcomes to ServiceNow, Jira, Snowflake, or any other downstream tool. Your system of record stays synchronized without the security team having to touch it.

### Slow Incident Response Due to Manual Access Revocation Steps

During a security incident, responders have to manually identify which systems a compromised user can access and revoke each grant one by one. That process can take hours, giving a potential breach more time to spread.

**How Tray.ai helps:** tray.ai connects your SIEM or EDR alerts directly to Opal's API so access suspension happens in seconds as part of an automated incident response playbook. The workflow also creates the incident ticket and notifies the team, so responders can focus on investigation rather than manual access management.

### Permission Drift Goes Undetected Between Review Cycles

Access granted for a project or temporary role change often sticks around long after the need has passed, especially when role changes in the HRIS aren't automatically reflected in Opal. That drift quietly piles up until it shows up as an audit finding.

**How Tray.ai helps:** tray.ai runs scheduled reconciliation workflows that compare live HRIS role data against Opal grants and triggers remediation automatically when drift appears. Access stays aligned with current job function without waiting for the next scheduled review cycle.

### Building and Maintaining Custom Integration Scripts Is Expensive

Engineering teams often build bespoke Python scripts or Lambda functions to wire Opal into other systems, but these scripts need ongoing maintenance, lack observability, and break when APIs change. The result is hidden technical debt sitting in the security team's infrastructure.

**How Tray.ai helps:** tray.ai has a no-code and low-code workflow builder with a native Opal connector, built-in error handling, and workflow versioning. Security and IT ops teams can build and maintain integrations themselves without engineering support, and tray.ai handles API changes and retries transparently.

## Agent features

### Look Up Access Request Details (Data Source)

Retrieve details of specific access requests including requester, resource, status, and approval history. An agent can use this to give context-aware responses or kick off downstream workflows based on request state.

### Query Resources and Permissions (Data Source)

Fetch information about available resources, apps, and their associated permission levels within Opal. An agent can then tell users what access options exist and what they're eligible to request.

### List User Access Entitlements (Data Source)

Retrieve the current permissions and resource access granted to a specific user. An agent can use this to audit access, catch over-provisioning, or answer user questions about what they currently have access to.

### Fetch Group Membership Information (Data Source)

Pull membership details for access groups and roles defined in Opal. An agent can use this to check whether a user belongs to a group before recommending access changes or escalations.

### Monitor Access Review Status (Data Source)

Retrieve the current state of ongoing access reviews including pending approvals, assigned reviewers, and completion rates. An agent can surface this data to compliance teams or send reminders when reviews are running late.

### Submit Access Request (Agent Tool)

Programmatically create an access request on behalf of a user for a specified resource or permission level. An agent can submit requests based on user intent or business logic, cutting out manual steps in provisioning workflows.

### Approve or Deny Access Requests (Agent Tool)

Take approval or denial actions on pending access requests within Opal. An agent can handle routine approvals based on policy rules or route edge cases to a human reviewer.

### Revoke User Access (Agent Tool)

Remove a user's access to a specific resource or group in Opal. An agent can trigger revocations automatically when someone is offboarded, violates a policy, or fails an access review.

### Add or Remove Group Members (Agent Tool)

Modify membership of access groups by adding or removing users. An agent can keep group memberships in sync with HR systems or org changes without anyone doing it by hand.

### Trigger Access Review (Agent Tool)

Initiate a new access review campaign for a specific resource, group, or user population. An agent can schedule or trigger reviews in response to compliance deadlines, new audit requirements, or detected anomalies.

### Update Resource Configurations (Agent Tool)

Modify settings or metadata for resources managed within Opal, such as visibility, ownership, or approval workflows. An agent can keep resource configurations current as security policies change, without manual intervention.

## Learn more

- Intelligent Integration: https://tray.ai/platform/intelligent-ipaas/
- Merlin Agent Builder: https://tray.ai/platform/merlin-agent-builder/
- Agent Gateway for MCP: https://tray.ai/platform/agent-gateway/
- Book a demo: https://tray.ai/contact/