What enterprise trust provides#
Enterprise trust is an additive, org-scoped governance layer on top of the workspace control plane. It provides visibility into trust posture, enterprise auth readiness, and compliance controls.
Trust dashboard#
The trust page at /dashboard/trust is visible only to workspace
operators (owner or admin role). It shows:
- Live controls: Evidence Vault, compliance export, and enterprise auth (SAML sign-in, SCIM provisioning, MFA policy) — operational today
- Operator workspace count in scope
- Governance root confirmation (workspace-scoped, additive)
Enterprise trust does not bypass workspace governance. Admin and reviewer roles cannot override workspace-level approvals or policies.
Enterprise auth configuration#
SSO, SAML and SCIM are live controls. GET /api/v1/enterprise returns the
current configuration and readiness.
| Feature | Status | Notes |
|---|---|---|
| SAML sign-in | Live | Verifies your identity provider's signed assertion, with a bounded clock-skew window and replay protection, before starting a session |
| SCIM provisioning | Live | Create, list, update, and deactivate users and groups over a per-workspace bearer token |
| MFA policy | Live | Require step-up authentication for enterprise-admin actions, toggle per org |
SAML sign-in#
When SAML is enabled, GET /api/v1/enterprise/saml/metadata returns SP
metadata XML with entity ID and ACS URL for your identity provider
configuration. POST /api/v1/enterprise/saml/acs verifies your identity
provider's signed response and starts the session. Every sign-in attempt,
accepted or rejected, is recorded in a forensic sign-in log.
SCIM provisioning#
POST/GET /api/v1/enterprise/scim/Users (and the matching
/Groups endpoints) create, list, update, and deactivate users and
groups per RFC 7644, authenticated with a per-workspace bearer token.
Every provisioning action is recorded in a forensic audit log.
Access control#
All enterprise endpoints require the org-operator role — the user must be an owner or admin in at least one workspace within the org. Non-operators receive 403.
Readiness model#
Enterprise auth readiness is dynamic, derived from actual org configuration:
| Readiness | Meaning |
|---|---|
| Live today | Feature is enabled and operational |
There is no pre-built integration for a specific identity provider. Any RFC-compliant identity provider can be used.