Per-tenant SSO, tenant management & approvals
Access starts at the identity layer: work accounts only, federated per tenant, with the platform approving new tenants and tenant admins approving their own members.
How it works
Each tenant connects its own SAML or OIDC provider, verified against its own DNS-confirmed domain — no shared identity pool across tenants.
Personal email sign-ins are rejected outright — access always traces back to a verified work identity.
A new tenant is provisioned transactionally and approved by the platform before anyone inside it can act.
Once a tenant exists, its own admins approve new members — nobody sees tenant data before a human lets them in.
Human control
Access changes are human approvals at two levels — platform for tenants, tenant admin for members — with no automatic grant path.