Enterprise Trust

What enterprise trust provides#

Enterprise trust is an additive, org-scoped governance layer on top of the workspace control plane. It provides visibility into trust posture, enterprise auth readiness, and compliance controls.

Trust stack#

Each layer builds on the one below. Enterprise trust does not replace workspace governance — it adds org-scoped visibility and controls on top.

  ┌─────────────────────────────────────────────────┐
  │  Compliance Export                               │
  │  CSV/JSON audit trails, evidence bundles,        │
  │  retention-aware data export                     │
  ├─────────────────────────────────────────────────┤
  │  Enterprise Trust                                │
  │  Org admin, SSO/SAML/SCIM, trust dashboard,      │
  │  authoritative governance mode                   │
  ├─────────────────────────────────────────────────┤
  │  Fleet Management                                │
  │  Multi-workspace visibility, drift detection,     │
  │  policy distribution, runtime health monitoring  │
  ├─────────────────────────────────────────────────┤
  │  Evidence Vault                                  │
  │  Immutable action receipts, custody model,        │
  │  provenance, evidence chain per task             │
  ├─────────────────────────────────────────────────┤
  │  Control Plane                                   │
  │  Sessions, dispatch, approvals,                   │
  │  policies, budgets, telemetry, A2A signals       │
  ├─────────────────────────────────────────────────┤
  │  Kernel                                          │
  │  4-level scope, policy engine, sandbox,           │
  │  tool execution, evidence capture                │
  └─────────────────────────────────────────────────┘

Trust dashboard#

The trust page at /dashboard/trust is visible only to workspace operators (owner or admin role). It shows:

• Live controls: Evidence Vault, compliance export, and enterprise auth (SAML sign-in, SCIM provisioning, MFA policy) — operational today
• Operator workspace count in scope
• Governance root confirmation (workspace-scoped, additive)

info Enterprise trust does not bypass workspace governance. Admin and reviewer roles cannot override workspace-level approvals or policies.

Enterprise auth configuration#

Configure SSO, SAML, and SCIM via the enterprise API. These are live, hardened controls, not stubs.

GET /api/v1/enterprise — fetch current config and readiness PUT /api/v1/enterprise — update config (operator-only)

SAML sign-in#

When SAML is enabled, GET /api/v1/enterprise/saml/metadata returns SP metadata XML with entity ID and ACS URL for your identity provider configuration. POST /api/v1/enterprise/saml/acs verifies your identity provider's signed response and starts the session. Every sign-in attempt, accepted or rejected, is recorded in a forensic sign-in log.

SCIM provisioning#

POST/GET /api/v1/enterprise/scim/Users (and the matching /Groups endpoints) create, list, update, and deactivate users and groups per RFC 7644, authenticated with a per-workspace bearer token. Every provisioning action is recorded in a forensic audit log.

Access control#

All enterprise endpoints require the org-operator role — the user must be an owner or admin in at least one workspace within the org. Non-operators receive 403.

Readiness model#

Enterprise auth readiness is dynamic, derived from actual org configuration:

info Configuring SAML certificates and SCIM bearer tokens is API-only today; a dedicated settings page is planned. There's no pre-built integration for a specific identity provider — any RFC-compliant IdP works.