OIDC & SAML
Okta and SAML paths for workspace SSO. Client secret stays in your IdP and our secrets store.
Built for governed teams
Identity first. Enterprise SSO opens the operating machine when you choose it — governed access with your existing identity provider.
Governed session
Single sign-on across the workspace surface. No second password tax — with optional Zero Trust for additional control.
Deterministic control
AI assists. Deterministic agents enforce envelopes: policy, human authority, and append-only receipts on consequential actions.
Edge & capacity
Cloudflare edge for public surfaces; private body for operators. Capacity and console credits stay versioned.