A system, comprising: a memory that stores executable components; and a processor, operatively coupled to the memory, that executes the executable components, the executable components comprising: an identity provider interface component configured to receive an identity record obtained from a corporate-level employee information system, the identity record defining at least an identity of an employee of an industrial enterprise and a role of the employee; an enrollment component configured to, in response to receipt of validation data indicating approval of the identity record, enroll the identity record as a user credential record defining a degree of access to an automation system granted to the employee; a device interface component configured to receive, from an industrial device associated with the automation system, an identity request that specifies an identity of a user attempting to interact with the automation system, the identity request being digitally signed; and security token component configured to verify an authenticity of the identity request based on the digital signature and, in response to determining that the identity specified by the identity request corresponds to the user credential record, to generate a security token that, in response to execution on the industrial device, enforces the degree of access to the automation system defined by the user credential record, wherein the device interface component is further configured to send the security token to the industrial device, and wherein the system is configured to enroll the identity record only if the identity record includes an authentic digital signature. a memory that stores executable components; and a processor, operatively coupled to the memory, that executes the executable components, the executable components comprising: an identity provider interface component configured to receive an identity record obtained from a corporate-level employee information system, the identity record defining at least an identity of an employee of an industrial enterprise and a role of the employee; an enrollment component configured to, in response to receipt of validation data indicating approval of the identity record, enroll the identity record as a user credential record defining a degree of access to an automation system granted to the employee; a device interface component configured to receive, from an industrial device associated with the automation system, an identity request that specifies an identity of a user attempting to interact with the automation system, the identity request being digitally signed; and security token component configured to verify an authenticity of the identity request based on the digital signature and, in response to determining that the identity specified by the identity request corresponds to the user credential record, to generate a security token that, in response to execution on the industrial device, enforces the degree of access to the automation system defined by the user credential record, wherein the device interface component is further configured to send the security token to the industrial device, and wherein the system is configured to enroll the identity record only if the identity record includes an authentic digital signature. an identity provider interface component configured to receive an identity record obtained from a corporate-level employee information system, the identity record defining at least an identity of an employee of an industrial enterprise and a role of the employee; an enrollment component configured to, in response to receipt of validation data indicating approval of the identity record, enroll the identity record as a user credential record defining a degree of access to an automation system granted to the employee; a device interface component configured to receive, from an industrial device associated with the automation system, an identity request that specifies an identity of a user attempting to interact with the automation system, the identity request being digitally signed; and security token component configured to verify an authenticity of the identity request based on the digital signature and, in response to determining that the identity specified by the identity request corresponds to the user credential record, to generate a security token that, in response to execution on the industrial device, enforces the degree of access to the automation system defined by the user credential record, wherein the device interface component is further configured to send the security token to the industrial device, and wherein the system is configured to enroll the identity record only if the identity record includes an authentic digital signature.