Statement of Work

Narrative Consulting LLC will design and implement a complete identity governance infrastructure for Client. This engagement delivers working RBAC/ABAC models, automated lifecycle workflows, privileged access controls, and operational documentation — the full foundation required for audit-ready identity management. Client's team will be equipped to operate and maintain the infrastructure independently upon handoff.

• RBAC/ABAC model implementation — roles, permissions, and attribute rules designed and configured in Client's IDP
• Provisioning/deprovisioning workflows — joiner/mover/leaver processes designed and automated where the stack supports it (Okta, Azure AD, Google Workspace); documented manual procedures where it doesn't
• Access review process — quarterly certification workflows with reviewer assignments and escalation paths
• Privileged access controls — just-in-time access, time-bound elevation, break-glass procedures
• Service account governance — inventory, ownership assignment, rotation schedules
• Operational runbooks — step-by-step procedures for the team that will own it day-to-day
• Integration architecture — connecting IDP, HRIS, SaaS apps, and SIEM/logging
• Handoff — 90-minute walkthrough session + 2 weeks of Slack/email support post-delivery

Working identity infrastructure plus complete operational documentation:

• Operational runbooks (step-by-step procedures)
• RBAC/ABAC matrix (roles, permissions, attribute rules)
• Architecture diagrams (current + implemented state)
• Policy templates (access control policy, privileged access policy)
• Service account inventory with ownership and rotation schedule

This engagement is expected to be completed within 3-5 weeks from the date of kickoff. Kickoff will be scheduled within 48 hours of SOW execution and deposit receipt.

• Client provides admin-level access to identity systems (IDP, HRIS, SSO admin consoles) within 48 hours of kickoff.
• Client team is available for weekly sync meetings (30-60 minutes each) throughout the engagement.
• Client's IDP supports SCIM and/or API access for automation (Okta, Azure AD, Google Workspace, or equivalent).
• Client designates a single point of contact with authority to approve configuration changes.
• An Identity Infrastructure Assessment has been completed (by Narrative Consulting LLC or equivalent) providing a baseline of current state and gaps.

• IDP, HRIS, or SaaS application licensing costs
• Custom application development or code changes to Client's products
• Ongoing maintenance or operations after the 2-week post-delivery support window
• Non-identity compliance domains (financial controls, physical security, etc.)
• Penetration testing or vulnerability scanning

Payment schedule:

• 50% ($4,250.00) due upon execution of this Statement of Work
• 50% ($4,250.00) due upon delivery of final deliverables

Payment accepted via ACH transfer or credit card. All invoices are net-15.

Any changes to the scope, timeline, or cost of this engagement require a written change order signed by both parties before additional work proceeds. No surprise invoices — ever.

This engagement begins on and is expected to complete within of the kickoff date. If Consultant anticipates a delay, Client will be notified in writing with a revised timeline.

By signing below, both parties agree to the terms and conditions set forth in this Statement of Work. This SOW is governed by the terms of the Master Services Agreement between the parties, if one exists. In the absence of an MSA, the terms of this SOW shall govern.