Identity & Access
Access control, SSO, and conditional access for every workspace
Control who signs in and how — SSO, MFA, role-based access, and context-based conditional access — without exposing tenant data across workspaces.
Running in production today: user management, access control, conditional access, SSO (SAML + OIDC), support access, and activity logs.
- Workflow
- What teams can do here
- Step 1
- Connect an SSO provider
- Step 2
- Set conditional-access rules
- Step 3
- Assign roles
- Step 4
- Audit account activity
How it works
Connect single sign-on
Federate logins over SAML 2.0 or OIDC with Google Workspace, Microsoft 365 / Entra ID or Okta, so people sign in with your identity provider rather than a separate password.
Set conditional-access rules
Write policies that evaluate at login and return allow, block or require-MFA based on IP/CIDR, country, time-of-day and device trust. Policies run in priority order and match only when every condition is satisfied.
Enforce MFA for privileged roles
Turn on server-enforced TOTP multi-factor authentication so sensitive roles must present a second factor, checked on the server rather than trusted from the client.
Scope roles per tenant
Assign role-based access so users only see their own organization, and route support access through an approval step instead of standing admin rights.
Watch and cut sessions
Session management tracks active JWT sessions, times out idle ones, invalidates everything on a server restart, and lets an admin force-log-out a user.
A worked example
Say a 120-person accounting firm decides its finance team may only reach the workspace from the office network, and always with MFA. An admin writes two conditional-access policies: a higher-priority rule blocking logins from outside the office CIDR range, and a rule requiring MFA for everyone else. A partner travelling abroad is blocked at login with a clear reason; back on the office VPN they get in, but only after the authenticator code. During a laptop-theft scare the admin force-logs-out the user's sessions from the session view in seconds, rather than waiting for tokens to age out.
Built around real workflows
Highlights below describe capabilities already present in the protected app behind this page.
- 01
- Conditional Access — allow / block / require-MFA by IP, geo, time and device trust
- 02
- SSO via SAML 2.0 and OIDC (Google Workspace, Microsoft 365 / Entra ID, Okta)
- 03
- Server-enforced TOTP multi-factor authentication for privileged roles
- 04
- Role-based access with tenant-scoped users and support-access approval
- 05
- Immutable audit and activity visibility on every action
- Product proof
- Already live in the product
- Backed by app modules
- Protected app route: /user-management
Frequently asked questions
See also: Mobile device management · Shared credential vault · Blog: What is endpoint security? · Blog: What is MDM? · DPDP compliance operations
Decide every login by policy, not by hope
SSO over SAML or OIDC, conditional-access rules on IP, country, time and device trust, server-enforced TOTP and kill-switch session control — identity guardrails that fail open, never lock you out.