The quality gate rejects rather than repairs. A worker record missing a manager or cost centre creates no identity and lands in an exception queue with a named HR owner.
Dynamic group evaluation is the slowest link at roughly four minutes for the estate, and it is on the joiner path. The design accepts that lag and states it rather than promising instant provisioning.
Group writeback to AD DS is one-way and scoped to the groups legacy applications actually consume. Writing everything back would recreate the on-premises directory as a second source of truth.
Cadence, stated plainly
Hourly HR ingest, ~4 minutes group convergence, 40-minute SCIM cycle. Worst case from hire event to a provisioned SaaS account is about two hours, which is why joiners are created seven days ahead of their start date.
Leavers do not wait for any of this: disable and session revocation are immediate and pushed, not polled (view 17).
~40 HR data defects per day at this population size. That number sizes the exception process; a design that assumes zero defects fails in week one.
Risks
Duplicate identities from rehires with a new employee_id. Detected by a weekly reconciliation report; there is no automatic merge, by choice.
SCIM connectors fail silently on individual applications. Provisioning logs are collected but per-application alerting is an open item.
The archive export is the only defence against an administrator deleting evidence. It runs nightly, so the exposure window is up to 24 hours.
