Complete
joiner-mover-leaver
in the physical world.
Identity platforms control digital access. GroWrk lets the same workflow provision, track, recover, and retire the physical device — without replacing your IdP, MDM, or ITAM.
- Joiner · Mover · Leaver
- Zero-touch ready
- MCP actions
- Audit evidence
Ready for MDM
Serial handed to enrollment program
- MDM
- Existing tenant
- Profile
- Security baseline
- First boot
- Supervised
webhookdevice.enrollment_ready
- Identity
- Policy
- Deploy
- Configure
- Enroll
- Asset
Illustrative partner interface · GroWrk executes behind it
Provisioning
an account is
only half the job.
A joiner gets an identity, groups, licenses, and app access in minutes. The laptop that access runs on is ordered by a different team, from a different vendor, on a different timeline, and tracked in a different spreadsheet.
Two lifecycles, one employee.
The identity record and the asset record drift apart from the first day.
Leavers are the risk.
Access is revoked in seconds; the device holding cached data can take months to come back.
Movers get ignored.
Role and country changes rarely trigger the hardware change they imply.
Evidence is manual.
Chain of custody and wipe certificates get assembled by hand at audit time.
Own the physical half of the
lifecycle you already orchestrate.
Your platform is already the place where joiner, mover, and leaver events are defined. Attaching real device operations to those events is a natural extension, not a new product category.
Complete the workflow
One trigger drives both the account action and the device action.
Close the offboarding gap
Revocation and retrieval start from the same event.
Asset truth
Ownership, location, and condition maintained alongside identity.
Automation depth
Real-world actions become part of your workflow engine.
Audit-ready records
Custody and disposition evidence retrievable through the API.
Complementary, not competitive
Works alongside the IdP, MDM, ITSM, HRIS, and ITAM already deployed.
One lifecycle,
digital and physical.
Each identity state change has a physical counterpart. GroWrk executes it and returns the result to your platform.
- 01
Identity created
A user is created and assigned to groups. Your workflow engine already knows role, location, and access profile.
- 02
Device policy resolved
Group membership maps to a hardware standard, so the device follows the same rules as the access profile.
- 03
Deployment created
GroWrk sources the unit and prepares it for your customer's management posture before it ships.
- 04
Enrollment ready
The device is registered for zero-touch so it lands in the existing MDM on first boot. GroWrk does not replace that MDM.
- 05
Asset assigned
The device record is bound to the identity, giving you one view of who holds what, where, and in what condition.
Software is only half the infrastructure.
Revoking a token is instant. Getting a specific laptop out of a specific apartment in a specific country, verified and wiped, is an operating network.
Sofia Martins
1 assigned device
- Asset
- GRW-PT-52140
- Assigned
- Sep 9
- Custody
- Employee
webhookasset.assigned
- Identity
- Policy
- Deploy
- Configure
- Enroll
- Asset
Step 05 · Asset assigned
POST/v4/orders
{ "id": "RTV-40218", "status": "scheduled", "custody": "employee" }
Your platform decides. GroWrk executes.
GroWrk complements the IdP, MDM, ITSM, HRIS, and ITAM already in place. It does not replace any of them.
The experience
- Identity and access lifecycle
- Workflow triggers and approvals
- Device policy definitions
- Agent and automation surface
- Compliance reporting UI
- Customer relationship
Webhooks
The infrastructure
- Sourcing and configuration
- Enrollment readiness for your MDM
- Delivery and swaps
- Retrieval and chain of custody
- Certified wiping and evidence
- Storage, redeployment, retirement
What changes when the
physical side is connected.
- 01
One joiner-mover-leaver lifecycle.
The same trigger that grants or revokes access also provisions or recovers the hardware that access runs on.
- No parallel manual process
- Consistent SLAs across both halves
- Fewer orphaned assets
- 02
Connect digital identity to
physical asset ownership.Every device carries an assignment history tied to real identities, locations, and custody transfers.
- Who holds what, right now
- Condition and warranty tracked
- Custody and wipe evidence on demand
- 03
Automate real-world actions
without replacing your stack.GroWrk sits underneath your workflow engine as an execution layer, alongside the tools your customers already run.
- Complements IdP, MDM, ITSM, ITAM
- Scoped API and MCP access
- Approval gates on high-impact actions
Software primitives for
physical operations.
Identity platforms typically use webhooks plus the REST API, and add MCP when they expose an agent surface.
POST /v4/orders { "asset_id": "GRW-DE-60441", "reason": "offboarding", "requires_approval": true, "wipe": "certified" }
REST API
Deployments, swaps, retrievals, custody, wipe evidence, and disposition.
Webhooks
Custody transfers, delivery, receipt, wipe, and disposition events.
CLI & Automation
Bulk retrievals and inventory reconciliation for large tenants.
MCP & AI Agents
Permission-aware tools so agents can act, not just advise.
White-label
Employee-facing retrieval communications under your brand where scoped.
Permissions & approvals
Scoped tokens, approval gates, and a complete audit log.
Give your IT agent the ability
to act in the physical world.
GroWrk exposes lifecycle capabilities over the Model Context Protocol, so an agent inside your platform can start real device operations inside real permission and approval boundaries.
Agents inherit the scopes of the user or service they act for. High-impact actions — purchases, retrievals, disposition — can require explicit human approval, and every action is written to the audit log.
Offboard Sofia. Revoke access and retrieve her MacBook.
- Identity access
- Revoked
- Assigned device
- MacBook Pro 14 · GRW-DE-60441
- Device retrieval
- Pending approval
One integration. An entire
physical operations layer.
Your developers work with a handful of software primitives. GroWrk absorbs the operational complexity underneath them.
- REST API
- Webhooks
- CLI
- MCP
- Procurement
- Configuration
- Deployment
- Warehousing
- Maintenance
- Retrieval
- Redeployment
- Disposition
How IT platforms package it.
Physical actions are usually sold as an operational tier on top of automation.
Automation tier
Physical actions unlocked in a higher workflow-automation plan.
Per-action pricing
Charged per deployment, retrieval, or certified disposition.
Compliance package
Bundled with custody and disposition evidence for regulated customers.
Enterprise add-on
Attached to multi-country enterprise agreements.
GroWrk does not set end-customer pricing. Commercial terms are agreed during partnership design.
Why GroWrk.
Execution layer, not another console
Designed to be driven by your workflows rather than to own the user.
Evidence by default
Custody transfers, inspections, and wipe certificates recorded as they happen.
Global reach
Retrieval and deployment supported across more than 150 countries.
Agent-ready
MCP tools with scopes and approval gates rather than open-ended automation.
IT & Identity questions.
How does identity lifecycle data trigger device actions?
Your workflow engine calls GroWrk when a joiner, mover, or leaver event fires. Group membership or role attributes resolve to a device policy, and the resulting deployment, swap, or retrieval reports back through webhooks so the identity record stays accurate.
Does GroWrk replace an MDM?
No. GroWrk prepares devices so they arrive ready for the customer's existing MDM — including zero-touch enrollment registration where supported. Management, configuration profiles, and policy enforcement stay in the MDM.
How does GroWrk work with IT asset management platforms?
GroWrk maintains the operational record — sourcing, custody, condition, location, and disposition — and exposes it through the API and webhooks. Partners typically sync that data into their own asset views or into the customer's ITAM rather than replacing it.
Can devices arrive MDM-ready?
Yes. Imaging, encryption baselines, accessories, and enrollment registration can be completed before the device ships, so first boot lands the machine in the correct management posture.
Can offboarding trigger retrieval automatically?
Yes. A leaver event can create a retrieval immediately, optionally behind an approval gate. GroWrk then coordinates pickup with the employee, records custody transfers, and performs certified wiping on receipt.
How do approval controls work for AI agents?
MCP tools are scoped to the permissions of the acting user or service. Actions with cost or compliance impact can be configured to require explicit human approval before execution, and every call is written to the audit log with the requesting identity.
How is device lifecycle history maintained?
Each device has one record for its entire life: procurement, configuration, assignments, location changes, maintenance, custody transfers, wipes, and final disposition. History is preserved across employees and across redeployments.
Can lifecycle actions be exposed directly inside our product?
Yes — that is the intent. Partners render device actions inside their own UI and workflows; GroWrk stays behind the API. White-label scope for any employee-facing communication is defined during partnership scoping.
Explore the other categories.
Connect digital access
to the physical device.
Bring your joiner-mover-leaver model and we will map it to GroWrk lifecycle operations.