Identity & Access

One login, many tenants

One3 plans a single global user account with a membership per tenant, so a consultant or agency staff member signs in once and switches between clients. Sign-in options include email and password with a breached-password check and lockout, passkeys, Google and Microsoft sign-in and TOTP multi-factor authentication. Access tokens are short-lived and carry the tenant, membership, licence and permission versions, so revoking a session or changing a role takes effect quickly.

Roles that come from the apps

Built-in roles are generated from each app's manifest, with permissions named {app}.{module}.{object}.{action}. Admins clone them into custom roles, create groups and assign roles at tenant, workspace, app, module, department, team or record-set scope. A seat assignment screen prevents licence and role mismatches.

Identities for agents

Every Digital Employee gets an agent identity with an owner membership. Its skill grants are always a subset of the owner's permissions, its workload tokens last 15 minutes or less, and it pauses automatically if the owner leaves. Service accounts and scoped, expiring API keys cover integrations. R4 Actions require step-up authentication.

Enterprise identity

Planned for Wave 2: enterprise SSO over SAML 2.0 or OIDC with domain verification, just-in-time provisioning and break-glass local admins; access reviews with evidence export; consent-based support access with a visible banner; segregation-of-duties rules; and a field-level security screen. Portal identity for customers and partners uses a separate client and cookie domain.

Planned for Wave 3: SCIM 2.0 provisioning, joiner/mover/leaver automation from People, an external AI system register, sign-in risk detection, terms-of-use acknowledgement, rule-based sharing and an access explainer that tells an admin which layer allowed or denied a request.