AI-powered infrastructure. Enterprise-grade control.

Control that ships with the product

These capabilities exist in NebulaStack today. Enablement still depends on your plan and how you deploy (SaaS vs self-hosted).

• RBAC

  Six built-in roles, checked against a permission matrix on every request, with time-boxed JIT grants as an emergency access path.

• SSO

  SAML and OIDC federated login, handled by the identity provider — not a NebulaStack-managed password.

• SCIM

  SCIM 2.0 provisioning for users and groups, with automatic role sync from your identity provider's group membership.

• Audit logs

  Hash-chained entries — each one embeds the cryptographic hash of the one before it.

• Policy enforcement

  Plan, policy gate, then apply — enforced by default in production, not advisory-only.

• OPA

  OPA evaluation, plus an optional multi-engine gateway (Checkov, CIS, Sentinel, custom rules).

• Private / local runners

  Deploy your own IaC executor instead of relying on a shared, multi-tenant SaaS fleet.

• Self-hosted control plane

  Run the control plane on your own infrastructure, split from the execution plane for hardened deployments.

• GitOps

  PR-based sync to GitHub, GitLab, Bitbucket, or Azure DevOps, or continuous sync via a real ArgoCD or Flux resource.

• Access controls

  Every authorization denial is written to the audit log. Denials are never discarded without a record.

Policy packs can evaluate plans against frameworks such as NIS2, DORA, GDPR, SOC 2, and CIS benchmarks. That is evaluation, not a certification that your organization is compliant.