Skip to content
FaradAiLab Docs
Enterprise Beta

Enterprise SSO & Role-Based Access Control

In modern engineering organizations, security teams must bind developer actions taken through AI agents (such as Claude Code, Cursor, or Windsurf) to verified corporate identities.

FaradAiLab Enterprise Edition integrates seamlessly with your enterprise Identity Provider (IdP) to enforce Single Sign-On (SSO), automate user lifecycle via SCIM 2.0, and map enterprise groups to granular workspace permissions.

graph TD
    subgraph EnterpriseIdP ["Corporate Identity Provider"]
        IdP["Okta / Microsoft Entra ID / Google Workspace\n(SAML 2.0 & OIDC Authority)"]
        Directory["Corporate Directory\n(Engineering, SRE, SecOps Groups)"]
        IdP --- Directory
    end


    subgraph ControlPlaneAuth ["FaradAiLab Enterprise Edition Identity Broker"]
        SSOAdapter["SSO Gateway\n(SAML 2.0 / OIDC / PKCE)"]
        SCIM["SCIM 2.0 Directory Sync\n(/api/scim/v2/Users & Groups)"]
        RBAC["RBAC Evaluation Engine\n(Workspace Scoping)"]


        SSOAdapter --- RBAC
        SCIM --- RBAC
    end


    subgraph Roles ["Enterprise RBAC Permissions"]
        R_Admin["Fleet Administrator"]
        R_SecOps["Security Policy Author"]
        R_Auditor["Compliance Auditor (Read-Only)"]
        R_Dev["Developer / Agent Operator"]
    end


    IdP ==>|"Federated SSO Handshake"| SSOAdapter
    Directory ==>|"Automatic SCIM Provisioning"| SCIM
    RBAC --> R_Admin
    RBAC --> R_SecOps
    RBAC --> R_Auditor
    RBAC --> R_Dev

Supported Identity Providers

FaradAiLab Enterprise Edition supports all major enterprise identity systems via standard open protocols:

  • Okta: Native Okta Integration Network (OIN) app with OIDC and SCIM 2.0 support.
  • Microsoft Entra ID (formerly Azure AD): SAML 2.0 enterprise application and Graph API user sync.
  • Google Workspace: Google Cloud Identity OIDC with service account domain-wide delegation.
  • PingFederate / OneLogin / Keycloak: Full SAML 2.0 federation and mutual certificate validation.

Role-Based Access Control (RBAC) Matrix

FaradAiLab Enterprise Edition organizes administrative privileges into clearly defined roles with least-privilege enforcement:

RoleDescriptionManage FleetsAuthor OPA PoliciesView Audit LogsExport ComplianceConfigure KMS / SSO
Fleet AdministratorFull platform management and infrastructure controlYesYesYesYesYes
Security Policy AuthorAuthors, tests, and deploys OPA / Rego security bundlesView OnlyYesYesView OnlyNo
Compliance AuditorRead-only access to tamper-evident logs and reportsView OnlyView OnlyYes (Masked)YesNo
Workspace OperatorManages developer node enrollment for a specific teamYes (Team)NoYes (Team)NoNo
Developer / Agent UserEnd user whose workstation proxy syncs organizational policiesNode OnlyNoSelf OnlyNoNo

Attributing Agent Invocations to Human Identity

One of the largest risks of autonomous AI agents is the lack of non-repudiation: if an agent executes an unauthorized database query or pushes code, traditional network proxies see only the agent’s IP address.

FaradAiLab Enterprise Edition solves this by binding the edge proxy session to the authenticated developer’s corporate identity:

  1. Terminal SSO Login: When developers initialize FaradAiLab Enterprise Edition, they authenticate via terminal browser OAuth/OIDC PKCE:
    Terminal window
    faradaiwire-ee auth login --org acme-corp
  2. Cryptographic Identity Token: A short-lived, hardware-bound JWT is issued containing the user’s User Principal Name (developer_upn), departmental tags, and security clearance level.
  3. Telemetry Enrichment: Every MCP tool call passing through Port 8090 is tagged with verified identity claims in the SIEM audit stream: 
    {
      "developer_upn": "david.ross@acme.corp",
      "entra_object_id": "84a1bc92-0481-4209-bc84-91284a12",
      "department": "Platform SRE",
      "tool_name": "execute_bash_command",
      "authorized_by_policy": "allow_sre_read_only"
    }

Automated Deprovisioning via SCIM 2.0

When an employee departs the organization or transitions out of an engineering role:

  1. The corporate HR system deactivates the user in Okta or Entra ID.
  2. The IdP dispatches an instant SCIM 2.0 DELETE or PATCH (active=false) webhook to FaradAiLab Enterprise Edition.
  3. The Control Plane immediately revokes all active edge mTLS client certificates and session tokens associated with the developer.
  4. The edge proxy on the developer’s laptop immediately locks down high-risk tools and transitions to fail-closed state.

Next Steps