Corma is built around a few core concepts that work together to give you visibility and control over your company's software. Understanding how these concepts relate makes it easier to see how access moves through your organization, from a single license to your entire SaaS stack.
Basic concepts
App
Apps are the software tools your company uses. Corma discovers them automatically through the browser extension, connects to them via a direct integration, or has an admin add one manually.
Every app also has a status: Authorized, Tolerated, To review, or Unauthorized. Authorized apps get an owner, the person accountable for managing it; apps can also be grouped into bundles for specific teams or roles.
In practice, most of what Corma tracks starts from an app being detected.
Status | Definition |
|---|---|
Authorized | An official app approved by admins for use. |
Tolerated | An app that isn't official but that users are allowed to use. Users don't get a browser notification when using it (if browser notifications are turned on in settings). |
To review | An app detected by Corma that an admin still needs to review. |
Unauthorized | An app no one in the company should use. Users are notified instantly if they try to use it in their browser (if browser notifications are turned on in settings). |
Deleting an app permanently removes all its related data in Corma (users, licenses, usage history). It has no effect on the app or its data outside Corma.
User
Users are the people in your company who hold access to apps. A user's HR status comes from your HR tool, and their IdP status (Provisioned, Active, Suspended, Archived, Deprovisioned, Unknown) is synced live from your identity provider.
A user moves through onboarding when they join and offboarding when they leave, and every license they hold follows that same journey.
HR status | Definition |
|---|---|
Employed | The user has an active employment contract. |
Terminated | The user's employment contract has ended. |
Upcoming | The user's employment contract hasn't started yet. |
Unknown | Corma doesn't know the user's HR status. |
License
A license is what actually connects a user to an app, the contractual right for that person to use it.
Licenses carry a type (Standard, Premium, Business/Enterprise, Freemium) and a role within the app (Admin, Editor, Viewer), and move through their own status as they're used, go idle, or get revoked.
License status | Definition |
|---|---|
Active | The license is active and has been used recently. The activity threshold can be set in Corma. |
Inactive | The license is paid for, but no recent activity has been detected. |
To be revoked | The license should be revoked, either because the user is being offboarded or after an access removal. |
Revoked | The license has been successfully revoked. |
Workspace
A Corma workspace is the container for all users, apps, licenses and settings belonging to one company or entity.
Larger organizations and IT partners managing several clients can run more than one workspace from a single account, fully isolated from one another. Nothing in one workspace is visible from another.
Organizing access
Access requests & removals
Access requests and access removals are how licenses get granted or pulled outside of the normal onboarding and offboarding flow.
An access request might come from:
an employee asking for a new tool
an admin provisioning access on someone's behalf
a manager requesting access for their team
An access removal works the same way in reverse, and both route through an approval flow before they take effect.
Approval flow
An approval flow is the chain of people who need to sign off before an access request is granted.
Every workspace has a default approval flow that applies to any app without its own configuration, and individual apps can define a custom flow with their own steps and approvers: a manager, a specific person, or the app's own tool owner.
Tool owner & access management owner
A tool owner is the person accountable for one specific app: they're the one who typically approves access to it and gets asked to confirm when access should be removed.
Not every app has a clear owner, though, and not every action can be automated. For those cases, a workspace sets an access management owner: the fallback person who steps in to provision or remove access by hand whenever Corma can't do it automatically.
Data source
A data source is any external system Corma connects to in order to pull in data: an identity provider, an HR tool, a finance tool, a SaaS app, or a ticketing system.
Corma sorts each data source into a category (idp, hr, finance, saas, or itsm), which tells it what kind of information to expect and how to use it elsewhere in the product.
Direct integration
A direct integration is a native connection to a specific app, rather than picking up its usage indirectly through SSO or the browser extension.
Direct integrations are what make one-click provisioning and deprovisioning possible. Where Corma doesn't have one, access still needs to move somehow, which is where tickets come in.
Managing the workspace
Admin
An admin is a user with full access to a workspace: integrations, users, licenses, provisioning workflows, and settings. Any existing admin can invite another.
Member & role
A member's role governs what they can see and do inside a workspace. Roles apply both to the people using Corma itself and, separately, to the access level Corma tracks on the licenses it monitors, like Admin, Editor, or Viewer within a given app.
Company domain
A company domain is an email domain approved for a workspace. Anyone signing up with an email on that domain joins automatically, without needing an invite.
HR Properties
HR Properties are the departments and job titles synced in from a company's HR tool, along with where each one came from and how many people belong to it. They're what let Corma scope groups, approval flows, and reporting by team or role, instead of just by individual.
Automating work
Workflow
A workflow is the sequence of steps Corma runs automatically for onboarding and offboarding, triggered by events like a user's start date or end date being reached.
Workflows belong to a workspace, and the timing of each trigger (how many days ahead it fires and at what time of day) is configurable. What happens if a step fails is configurable too: stop the whole process, skip the step silently, or skip it and hand it off as a ticket.
Ticket
A ticket is Corma's record of a single access-related action: an access request, a license change, an account creation or revocation, or a step from an onboarding, offboarding, or workflow automation.
Every ticket carries a context showing what triggered it, and an automated action showing what Corma actually does to fulfill it, whether that's an automatic step or one flagged for a human to finish by hand. Approved access requests generate their own provisioning ticket underneath them, so you can trace a request through to the action it caused.
OCR (invoice import)
OCR is one of the ways Corma gets expense data into the platform: instead of connecting a finance tool or entering costs by hand, you can upload a PDF invoice and Corma reads it, automatically extracting the cost, currency, date, and supplier, and mapping it to the right app.
API & API key
Corma's public API lets you pull workspace data (users, licenses, apps) into your own systems, or build on top of it. API keys are generated under Settings → API. Today, a key grants full access to every public endpoint: there aren't yet separate scopes for read-only or limited access.
MCP
The Corma API MCP server is what lets an AI tool, like Claude, Cursor, or VS Code, query your Corma workspace data directly, using natural language instead of writing API calls by hand.
Agents
Browser extension & OS Agent
The browser extension and the OS Agent are both installed software that report back to Corma, but at different levels.
The browser extension sits inside an employee's browser and detects app usage there. Its state for a given user is No Data (never fetched), No Recent Data (nothing fetched in the last week), or Live Data (currently being fetched). The OS Agent is installed on the device itself and reports installed software and activity at the operating-system level, visibility the browser can't provide on its own.
AI Agent
An AI Agent is an automation that figures out how to complete a goal rather than following a fixed script. It handles things like logging in, provisioning, deprovisioning, or reading license data for apps that don't have a direct integration.
It runs inside an isolated browser session scoped to one task, and a Custom Agent is the no-code way to train one yourself, by performing the task once while Corma watches.
Risk & security
Risk score
Corma scores each app's risk, shown as levels like "High risk", based on four factors sourced from web scraping and security APIs. It reflects the potential impact if that app's data were leaked, not how likely a leak actually is.
Notification channel
A notification channel is where Corma sends alerts about apps, requests, and reviews. Email is on by default; Slack and Microsoft Teams are both connectable; Google Chat is planned but not yet available.
Secured extension authentication mode
An optional setting that restricts what the browser extension collects to only users who've authenticated through a verified SSO or direct Corma login, rather than trusting whatever's in the browser's session or local storage.
Shadow IT
Shadow IT is software employees use without official authorization or IT visibility into it. It's a compliance and security risk under frameworks like DORA and ISO 27001, and it's a core part of what Corma exists to surface: detecting it through usage and finance data, then letting admins decide whether to authorize, tolerate, or block it.
How these concepts fit together
The way to think about Corma is:
apps are the tools your company uses
users are the people who need access to them
licenses connect a user to an app, and carry the status that tells you whether that access is still needed
access requests and removals change who holds a license, routed through an approval flow
workflows automate that change for onboarding and offboarding, and tickets catch everything a workflow can't finish on its own
data sources and direct integrations are how Corma gets and acts on information from the rest of your stack
the browser extension, OS Agent, and AI Agents are how Corma sees and acts on all of the above without manual work
a workspace is the boundary all of it lives inside
Corma is built around a few core concepts that work together to give you visibility and control over your company's software. Understanding how these concepts relate makes it easier to see how access moves through your organization, from a single license to your entire SaaS stack.