SSO & advanced RBAC
SAML/SSO, SCIM, granular roles per tenant and per environment.
Enterprise identity from the start: SAML/SSO and OIDC for authentication, SCIM for automated user provisioning, and role-based access control scoped per tenant and per environment — not just a global admin/member split.
- SAML/SSO and OIDC federated login
- SCIM provisioning keeps access in sync with your identity provider
- Roles scoped per tenant and per environment
How it works
Your identity provider handles authentication over SAML or OIDC; SCIM then keeps user and group membership in sync automatically. Every request is authorized against a role/permission matrix, with time-boxed just-in-time grants as a documented emergency access path. Every denial is written to the audit log. Denials are never discarded without a record.
When the role/permission matrix denies a request, the just-in-time grant path is the documented way to get temporary access — not a support ticket. Every grant and every denial writes to the audit log, so emergency access is never invisible.
A real permission-denial audit entry
{
"action": "environments:apply",
"decision": "denied",
"code": "role_permission_denied",
"userId": "usr_4a1c",
"hashPrev": "9f2a1c...e04b"
}