One source of organizational truth, holding up cohort, studio, capabilities and executor.
Standard OIDC / OAuth2: ES256 + PKCE, forced refresh rotation, rotating JWKS, and device flow. Tokens carry the minimal claim set and profiles are always resolved authoritatively through userinfo.
The org tree, employment relationships and people search form the single source of truth for the platform-wide directory. Change one person in identity once, and the desktop, server and IM all follow — directory drift is eliminated at the root.
The whole platform has three roles — platform_admin / tenant_admin / member — with authorization centralized in identity and scopes consumed uniformly. Adding a product means adding one catalog row, with zero downstream changes.
Log in once and cohort, studio, capabilities and executor need no second sign-in. Token exchange is confined to the same user across first-party products, lateral or downscoped — holding a token never escalates privilege.
The AI engine receives downscoped tickets of a single scope, short TTL and a pinned path. The engine holds no model-provider keys, so even a leak burns a single blast radius.
"Which tenant am I in" is written as a single truth in the token; switching triggers re-issuance, authorization is re-checked on every issuance, and a revoked role takes effect immediately — it never drifts into over-privilege.
Standard SCIM inbound provisioning with Okta / Azure AD supported out of the box, plus external IdPs via SAML / OIDC federation on both tracks. Onboarding, offboarding and department moves take effect automatically.
Every audit row carries a SHA-256 content hash plus the previous row's hash, chaining rows together. Insertions, deletions, reordering and edits are all detectable — "who did what" is verifiable and tamper-evident.
Custom fields use a declarative schema; sensitive data such as ID numbers are stored encrypted with AES-256-GCM, returned masked, and any plaintext read is logged — meeting PIPL's hard requirements for traceability of sensitive personal information.
Identity is the foundation — and the starting point for data isolation and governance.
Sign in once with your corporate account; SSO connects every product.
The organization and AI employee directory is maintained here in one place and followed everywhere.
Departments / positions / roles — one permission model across products.
Data is isolated by tenant by design; anything out of bounds rolls back.
Book a demo to see unified identity run through the entire TUEO suite.