The one rule we never break: a single policy decision point
No service computes its own authorization answer. Here is why that discipline is worth the inconvenience.
An audit chain the customer can verify
Hash-linked events, a verdict on every page, and an export your auditor can check independently.
Break-glass access that is a control, not a backdoor
Emergency access granted immediately and reviewed afterwards — because break-glass nobody reviews is standing access with a dramatic name.
Data residency that the platform actually enforces
Pin a workspace to a jurisdiction and the policy decision point refuses to place it elsewhere.
Agent runtime: guardrails, budgets and a kill switch on the hot path
An agent is a principal with an allow-list, a blast radius and a budget — and a stop that takes seconds.
Offboarding a leaver in one sweep across five pillars
Nobody can enumerate what one person can reach by hand. So we made it one button, with a second pair of eyes.
Every resource is a URN, and every decision goes through one PDP
One grammar for identity across five pillars, and why that makes audits boring.