Identity and Access
Verdictan uses members, teams, roles, IAM policies, authentication controls, and machine credentials. Select the control that fits the task.
Access model
member or team
↓ assignment
role
↓ attachment
IAM policy
↓ evaluation
action + resource + conditions
A matching deny overrides a matching allow. A matching allow gives access. Verdictan denies access when no allow matches.
Authentication verifies the principal identity. Authorization controls the permitted actions for that principal. SSO, MFA, and passkeys increase authentication. They do not give product permissions.
Select the correct control
| Task | Control |
|---|---|
| Add a person to the organization | Invitation and member lifecycle |
| Group members by function or ownership | Team |
| Package a job function | Role |
| Define allowed or denied actions and resources | IAM policy |
| Use one provider for workforce login | SAML or OIDC SSO |
| Provision and suspend directory users | SCIM |
| Use stronger interactive authentication | MFA/passkey and organization MFA policy |
| Give a third-party application delegated user access | OAuth client with PKCE, user consent, and registered scopes |
| Let automation call the API | Scoped token with the smallest applicable role |
Do not use a shared human account for automation. Do not give a broad Owner role to automation.
Roll out the controls
- Record all owners, members, teams, roles, policies, tokens, and OAuth clients.
- Create policies and roles with minimum permissions for shared job functions.
- Assign roles to teams.
- Give a direct user grant only for an approved special case.
- Test with a non-owner account.
- Configure MFA requirements.
- Resolve the browser callback boundary in the SSO guide.
- Configure SSO without enforcement.
- Test SSO without enforcement.
- Add directory mappings and SCIM where necessary.
- Test login, recovery, deprovisioning, and emergency ownership.
- Verify the live callback path, complete login, and recovery ownership.
- Enforce SSO.
- Review Trail after each administrative change.
Isolate human and machine access
| Principal | Recommended credential |
|---|---|
| Console user | Password, SSO, MFA, or passkey session |
| Human CLI administrator | verdictan auth login profile |
| Control-plane automation | Scoped API token |
| Connected gateway | Gateway machine/runtime credential |
| Application sending model traffic | Request-execution token applicable to the gateway |
| Third-party delegated application | OAuth access token with registered and approved scopes |
Do not reuse a gateway machine credential as an application bearer token.
Review access
Do these reviews after role changes and at planned intervals:
- Make sure that Owner access continues to be necessary for each owner.
- Review members who are not active and members with pending invitations.
- Review team membership and direct user grants.
- Examine role actions and assignments.
- Remove OAuth clients, redirects, tokens, and SCIM credentials that are not used.
- Make sure that SSO certificates, discovery metadata, and mappings are correct.
- Verify MFA recovery ownership.
- Keep Trail evidence for the review.