Repository access
Alex · inherited grant
Jo · deactivated Session ended
← Back to Home
Enterprise Identity
Your directory already knows your people.
Carry that authority into agent work. Federate sign-in, provision groups and remove access through the identity systems you already operate.
Directory identity meets agent access01 / 04Connect identity
Bring the directory into the sign-in path.
Identity provider
Jules · Operations
Amira · Operations
Taylor · Finance
IDEnterprise sign-inIdentity established
Use your configured enterprise identity provider.
Connect an identity provider so enterprise sign-in can establish the employee identity.
A CLOSER LOOK
Your org chart becomes an access boundary.
Your identity provider owns membership. Fabriq resolves the corresponding organization, team and member grants when an agent acts.
Directory grant resolutionOrganization
ORGANIZATION
Northwind
Federated from Okta or Microsoft Entra IDInvoice access
Priya · team grant
Member override No delete scope
Provision from the directory.
Okta and Microsoft Entra ID support sign-in, provisioning, groups and offboarding. Other OIDC providers support sign-in.
Resolve each level.
Grants follow organization, team and member settings, including per-user overrides. These access grants are distinct from a policy’s configurable fallback.
Separate administrative authority.
The platform admin plane has separate authentication, TOTP and recovery codes.
One identity lifecycle, including agents.
Federate with your provider.
Okta and Microsoft Entra ID support sign-in, provisioning, groups and offboarding. Other OIDC-compatible providers support sign-in.
Resolve organization, team and member.
Organization, team and member grants bound tool access. Agent permissions and access assignments are configured separately.
Separate administration.
Platform administration uses a separately hardened authentication plane with TOTP and recovery codes.
Revoke without waiting for expiry.
Session revocation takes effect immediately. Disabling an agent covers the non-human side of access.
Identity lifecycle questions
Do we need to maintain two user directories?
People and groups are provisioned from the IdP and removed through the same lifecycle. Fabriq applies grants to those identities rather than creating an independent source of membership.
When does session revocation take effect?
Revocation ends the session immediately instead of waiting for token expiry. Removing group membership also removes the authority that group supplied.
Can an agent elevate its user into an administrator?
No. An agent acts within the signed-in user’s identity and its own scope. It cannot create authority that the person does not hold.