Authority Governance Feature Matrix

Recursive n-depth node trees. Region → Franchise → Store. Real orgs, not flat groups.

Define a template once. New locations auto-provision roles, groups, permissions instantly.

Scoped UI for non-technical managers. Provision users for their team only.

Unified app dashboard aggregating Okta, Azure, PingOne. If you have the role, you see the button.

Context-aware support routing. Acquired Co users see their support info automatically.

Employees in Okta manage customers in Auth0. One glass pane, multiple identity backends.

Set Once, Override Where Needed — services, support settings, and domains cascade through NodeType templates and org hierarchy.

Control capacity at every level: User/Node quotas limit team size, User/Role quotas limit role assignments. Both inherit through templates.

Pre-seed users via API. When they SSO in, the system adopts them with pre-configured access.

Audit survives user deletion. Name, email, context denormalized into every event.

Every grant accepts starts_at and expires_at. Access revokes itself automatically.

One login, infinite personas. Switch from Store A to Store B manager instantly.

VP of Sales owns the Salesforce role. They manage assignments without full admin rights.

Sensitive metadata fields encrypted in the database. Command interface for key rotation.

Bulk data operations with encryption. Move data safely between environments.

Engine-enforced minimal permissions. Users and agents get exactly what they need, nothing more.

Central inventory of all AI agents with ownership, purpose, and accountability.

Every agent declares authorized scope at creation. Reviewable. Auditable.

Agents expire unless renewed. No immortal processes lurking in production.

Revoke by owner, region, or globally. Incident response in seconds.

Created → Activated → Renewed → Suspended → Terminated. Full history.

Every agent has an owner. Orphaned agents are impossible by design.

An out-of-the-box authority pattern for agent fleets: default governance nodes give every agent a home, agents act under operating personas with explicit roles, and one fleet node governs review, rotation, and revocation.

70+ governed MCP tools exposed by active persona, scope, resources, and authority context.

Rich diagnostic logs with 6-stage failure analysis. AI reads why and self-corrects.

Industry templates (Automotive, Franchise, Healthcare) that teach AI your business model.

Every AI decision captures: agent ID, model version, validation factors, tool chain.

Human corrections become DPO training pairs. Your AI learns from mistakes.

Runtime-accessible tool guidance, AI hints, self-diagnostics, schema resources, and authority patterns.

"Sarah from Technology" resolves in one call. Scope keywords: from, in, under.

Out-of-scope entities are invisible, not just denied. Zero enumeration attacks.

Every response carries domain intelligence. Success paths recommend follow-up operations. Failure paths point to permission-checked recovery tools. Out-of-scope resources never appear.

Events capture the active persona, scope, effective authority, and visible tool universe for each governed action.

Three role types: InternalRole (control plane), ResourceRole (IdP bridge), AppAccessRole (launchpad).

Parent uses Okta, Acquired Co uses Entra ID. One hierarchy, automatic routing.

Deploy full architecture with service stubs. Fill in secrets later to go live.

IdP calls IdentityRM via inline hook. We inject permissions into the user's token.

Create APIs, Scopes, Roles inside Auth0 and PingOne automatically.

Every capability as a governed MCP tool. Dashboard optional—deploy headless.

Business answers, not just logs. Which franchises are growing? Is this role actually used?

Trace from high-level audit event to low-level operational log. Full decision chain.

AI agents run compliance reports across hierarchy. Flag roles for review automatically.

Mount customer MCP tools into IdentityRM and inherit persona context, permission checks, resources, events, and proof.

Register a tool, get permissions auto-created. Immediately visible in admin UI.

10+ OOB authority patterns exposed through browse_authority_patterns with previews, comparisons, guidance, examples, schema context, and service-form inputs.

Describe how your organization operates; the Authority Design Engine matches the closest pattern, asks only the material questions, and assembles a live, explainable model — emitted as a versioned pattern and preflighted seed, ready to apply.

A packaged skill teaches Claude Code and Codex to design and validate complete authority models — hierarchy, node types, custom internal roles, agents, grants, and seeds — through the same preflight and apply gates the Authority Designer uses. Complex multi-region models have been built this way, end to end.

Your tools get decision traces, correction tracking, correlation IDs, and authority context fingerprints. No extra code.

Tiered access: Starter (internal permissions), Platform (10 tools), Enterprise (unlimited).