One fabric for every identity decision
Authentication, authorization, provisioning, and audit — designed as one system, because your attackers treat them as one system.
Every IdP your buyers run. One integration on your side.
SAML, OIDC, and the on-prem directories that never made it to a slide deck. Your customers' IT teams onboard themselves through a guided portal — your engineers never see another metadata XML.
- Self-serve connection portal, white-labeled to your product
- Automatic attribute mapping with drift detection
- IdP-initiated and SP-initiated flows, per-connection policy
The org chart is alive. Stay synchronized with it.
SCIM 2.0 provisioning built for six-figure directories: joiners productive in their first hour, leavers locked out before their badge stops working.
- Real-time provisioning, deprovisioning, and group mapping
- Conflict reconciliation for the org charts that lie
- Instant session revocation on offboarding events
Challenge the 5% that matter. Never the other 95.
Passkeys as the default, risk signals as the gatekeeper. Device posture, network reputation, travel feasibility, and behavioral baselines decide when to step up — your users mostly never notice us.
- Passkeys, TOTP, hardware keys, and push — per-policy
- Risk engine tuned on billions of authentications
- Step-up hooks for your most sensitive in-app actions
Who can do what — as code, not tribal knowledge.
Relationship-based access control with a declarative policy language, versioned deploys, reviewers, and a playground. Answered at the edge in single-digit milliseconds.
- Roles, relationships, and resource-level permissions
- Policy versioning with approvals and instant rollback
- Batch checks and list-filtering APIs for your UI
model finance {
type report {
relation owner: user
relation team: group
permission export = owner | team.lead | org.controller
}
}
# playground
? can l.brandt export report:q3-forecast
✓ ALLOW — via team.lead (treasury) · evaluated in 4msSee every session. End any of them. Right now.
A living map of every human and machine session across your product — with device posture, anomaly flags, and revocation that propagates globally in under a second.
- Org-wide session search with sub-second revocation
- Device fingerprinting and posture signals
- Anomaly detection wired to your SOC's pager
When the auditor asks, the answer is a query.
Every identity event, hash-chained and immutable, queryable for seven years, streaming to your SIEM in real time. Evidence, not archaeology.
- Cryptographically verifiable event chain
- Native exporters: Splunk, Datadog, S3, Snowflake
- Per-event actor, IP, device, and policy context
Your newest users aren't human. Govern them anyway.
Scoped, expiring, fully-attributed credentials for AI agents acting on behalf of your users — with hard ceilings, human escalation, and an audit trail that answers 'who let the agent do that?'
- Delegated grants bound to a human principal
- Scope and spend ceilings enforced at the token layer
- Automatic escalation when an agent leaves its lane
Running in production at
See the whole fabric, on your own stack
Bring your architecture diagram. Our identity architects will map every box on it to a migration plan — on the first call.
Enterprise only · No self-serve tier · Typical procurement to production: 6 weeks