I'm interested to hear your follow on thoughts around how to solve the “missing pieces” problems. For the missing attributes, I like your #3 suggestion in the slides (OAuth + ArisID) since it does roundtrip all parties and allows for compliant attribute retrieval. The questions that should be answered are:

What attributes are required to provision an account (or role or entitlement) on the cloud based application? (CARML)
Where are those attributes sourced from? (identity sources and/or actual people)
How is the sourcing and use of attribute data authorized? (IAS, OAuth?)

In the enterprise provisioning realm, to answer these questions you could create a “provisioning policy”, which defines per application how the attributes values are sourced? Do they come from the requestor, the application administrator, or are they mapped / calculated from known identity information? This becomes difficult in a cross domain scenario and will require the use of standards, as you suggest.

I'm also interested in your thoughts on deprovisioning, metering, and closing the audit and control loop with the enterprise-side Identity GRC system.

Cheers,

Mat Hamlin