Control
Your identity system stays in charge
Sign in with your own identity provider, provision people automatically, and give each role only what it needs.
People
Synced from your provider- Priya N.priya@acme.exampleReviewer
- Sam O.sam@acme.exampleReviewer
- Mia K.mia@acme.exampleAuditor
- Dan R.dan@acme.exampleOwner
What each role can do
| Row | Decide | Edit policy | Export |
|---|---|---|---|
| Reviewer | |||
| Auditor | |||
| Policy author | |||
| Owner |
Leaver in your directory
- Removed in your provider
- Access ends here too
- Open reviews reassigned
Why it matters
What sso, scim and roles changes
- Sign in with your own identity provider.
- People are added and removed automatically.
- Each role gets only what it needs.
- Another set of passwords to look after.
- Leavers keep access until someone remembers.
- Everyone gets the same powers.
The resultAccess follows your directory.
What you get
SSO, SCIM and roles, in practice
Single sign-on
OIDC with your identity provider. Reviewers use the account they already have.
SCIM provisioning
People are added and removed from your directory, not by hand.
Custom roles
Define who can decide, at what risk level, and who can change settings.
How it works
Step by step
- 1
Connect your provider
Set up OIDC.
- 2
Sync people
SCIM adds and removes accounts.
- 3
Assign roles
Built-in or your own.
- 4
Checked every time
Permission and risk level, on each decision.
Questions
About sso, scim and roles
Does it work with my provider?
Any provider that supports OIDC.
Can SSO be switched off by one person?
It is a protected action, so it can need a second owner.
Next
Works well with
Know what your agents did.
Start free. Guard your first agent in a few minutes, and keep a record anyone can check.
- Free plan, no card
- Signed, chained decisions
- Checked offline, without us
Signed decision
- Decision
- Approved, 2 of 2
- Action
- refund.issue, £540
- Rule
- Two reviewers must agree
- Sealed
- 14:09, key 7f2c
- Hash
- 5be2…7c44
Checked on your own machine
- Signature matches the public key
- Decision is in the log
- Every link before it adds up