Authority Models & Enterprise Scale

200 Partners. One Hierarchy. Not 200 IdP Subscriptions.

Best for: CFO Enterprise Architect VP Partnerships

The Challenge

True partner isolation traditionally requires a separate IdP org per partner — 200 partners means 200 subscriptions, 200 connectors, and an IdP bill that makes the CFO's eye twitch
Onboarding a new partner means provisioning a new org, configuring a new connector, and testing isolation — months of work before the partner sees a login screen
Namespace collisions are a constant headache: john@partnerA and john@partnerB cannot coexist in a single IdP org without ugly workarounds

Node-level isolation: each partner is a fully isolated node in one hierarchy — true separation without separate IdP orgs, no cross-partner data leakage by architecture
Duplicate usernames just work: john@partnerA and john@partnerB coexist naturally because each node is its own namespace — no prefixes, no hacks
One deployment, unlimited partners: onboard a new partner in minutes by creating a node, not months by provisioning an org. Fixed + per-user pricing, not per-tenant

Hub-and-Spoke	IdentityRM
200 IdP orgs	1 deployment
200 org-to-org connectors	0 connectors
Per-org licensing	Per-user licensing
Months to onboard new partner	Minutes to create new node