IAM, admin & enterprise

Guide: Admin, SSO, SCIM & tokens.

Capabilities

• RBAC — additive org/project roles incl. governance_admin, executive_viewer (see Roles).
• Auth — email/password JWT with rotating refresh tokens; password change revokes sessions.
• OIDC SSO — per-org config, JIT provisioning, “Sign in with SSO”.
• SCIM 2.0 — Users CRUD + Groups (role mapping) behind scim-scoped tokens.
• Service-principal tokens — scoped rat_… bearer tokens for automation; masked secrets.
• Data retention — per-org windows with nightly purge.
• GDPR erasure — anonymize + revoke + audit; self-erasure blocked.
• Audit log — filterable, cursor-paginated record of every mutation.
• Tenant usage & health — usage counters, health roll-up, RED metrics.
• Multi-project workspaces — projects within an org, RLS-isolated.
• Public API & OpenAPI — live Swagger explorer, export package, release compare.