User
A human actor in your tenant.
- iduuid
- emailstring
- roleenumowner|admin|lead|member
- teamsjsonstring[]
- sso_substringfrom IdP
FOUNDATIONS · IDENTITY
Who can do what.
On one orbit.
Three rings: org roles, team scopes and service accounts. Every permission resolves through the same policy engine, and every lookup is auditable.
IDENTITY · ROLE ORBIT
Who can do what, and why.
Every actor in your tenant lives on one of three rings. Click an orbit point to see the effective permission set — resolved against policies, team membership and rate limits.
ORG ROLE
Owner
Effective permissions at this point on the orbit, resolved against current policy and scope membership.
memory:*policy:*billing:*audit:*
FOUNDATIONS · IDENTITY SCHEMA
Three objects. One policy.
ServiceAccount
A non-human actor — API token, webhook, SDK agent.
- iduuid
- kindenumtoken|webhook|sdk|sso
- scopesjsonstring[]
- rate_rpmnumber
- owner_idref→ User
Policy
Declarative rule that resolves scopes against actions.
- iduuid
- subjectenumrole|scope|actor
- effectenumallow|deny
- actionsjsonstring[]
- resourcesjsonglob[]
PLATFORM · CLOSE THE LOOP
One identity fabric. Every actor on the axis.
People, teams and service accounts resolve against the same policy engine — so an API token cannot quietly do something a human could not. We will show you the matrix on your own tenant.