We'd rather tell you what broke.

Every deprovisioning tool we looked at reported that a revoke ran. None would tell you what the vendor said back. A job that returns 403 and a job that succeeds both close the ticket, and the difference surfaces months later in an access review, or in an incident.

So we built the opposite. A system is marked revoked only when the vendor confirms it. Anything PurpletGo cannot act on or verify is flagged for manual action with the reason, and "failed" is an outcome rather than an error swallowed in a log. The case will not close while anything in it is unresolved.

That principle costs us things we would rather have. We ship 33 connectors and call only 6 of them Live, because only those have been verified against a live vendor account. The other 27 stay marked Beta until they pass the same test. A connector count is easy to inflate. We would rather publish the smaller honest number.

Live does not mean unconditional, either. Slack revocation goes through Slack SCIM, which Slack offers only on its Business+ and Enterprise plans. Slack alerts and approvals are a separate connector and work on any Slack plan.

It applies to what we cannot do, too. PurpletGo does not discover shadow IT. If an app was never connected to your identity provider, no offboarding tool can see it, and we do not imply otherwise. When a vendor has no deprovisioning API at all, we mark it as needing manual action rather than quietly skipping it and showing you a clean run.

None of this makes for a shorter demo. It makes for a record you can hand an auditor without reading it first.