Abstract: The disclosed technology teaches a computer-implemented method of enabling identity governance administration to examine the state of identity management objects at an arbitrary prior time. The method includes maintaining a data store of identity management objects used for identity governance administration, including specification of user roles from which permissions or authorizations derive and recording in the data store copies of identity management objects with an as-of time stamp at each creation, change and deletion of each identity management object. Also included is retaining time-stamped versions of the objects for a queryable time window. The method also includes receiving a query with an as-of time criteria for at least some of the identity management objects and returning responsive objects from which the permissions or authorizations were derived at the as-of-time. Responding to the query with the responsive objects that correspond to the as-of time criteria in the query is also disclosed.