What enterprise trust provides#
Enterprise trust is an additive, org-scoped governance layer on top of the workspace control plane. It provides visibility into trust posture, enterprise auth readiness, and compliance controls.
Trust stack#
Each layer builds on the one below. Enterprise trust does not replace workspace governance — it adds org-scoped visibility and controls on top.
┌─────────────────────────────────────────────────┐
│ Compliance Export │
│ CSV/JSON audit trails, evidence bundles, │
│ retention-aware data export │
├─────────────────────────────────────────────────┤
│ Enterprise Trust │
│ Org admin, SSO/SAML/SCIM, trust dashboard, │
│ authoritative governance mode │
├─────────────────────────────────────────────────┤
│ Fleet Management │
│ Multi-workspace visibility, drift detection, │
│ policy distribution, runtime health monitoring │
├─────────────────────────────────────────────────┤
│ Evidence Vault │
│ Immutable action receipts, custody model, │
│ provenance, evidence chain per task │
├─────────────────────────────────────────────────┤
│ Control Plane │
│ Sessions, heartbeat, dispatch, approvals, │
│ policies, budgets, signals, telemetry │
├─────────────────────────────────────────────────┤
│ Kernel │
│ 4-level scope, policy engine, sandbox, │
│ tool execution, evidence capture │
└─────────────────────────────────────────────────┘
Trust dashboard#
The trust page at /dashboard/trust is visible only to workspace
operators (owner or admin role). It shows:
- Live controls: Evidence Vault, compliance export — operational today
- Planned controls: Org-level admin, SSO, SAML, SCIM — roadmap items
- Operator workspace count in scope
- Governance root confirmation (workspace-scoped, additive)
info Enterprise trust does not bypass workspace governance. Admin and reviewer roles cannot override workspace-level approvals or policies.
Enterprise auth configuration#
Configure SSO, SAML, and SCIM via the enterprise API:
GET /api/v1/enterprise — fetch current config and readiness
PUT /api/v1/enterprise — update config (operator-only)
| Feature | Status | Notes |
|---|---|---|
| SSO | Live | Enable/disable per org |
| SAML | Stub | Metadata endpoint exists, IdP integration pending |
| SCIM | Stub | Provisioning endpoint exists with session auth, bearer-token IdP auth pending |
SAML metadata#
When SAML is enabled, GET /api/v1/enterprise/saml/metadata returns
SP metadata XML with entity ID and ACS URL.
SCIM provisioning#
POST /api/v1/enterprise/scim/Users accepts provisioning requests.
Currently returns 202 Accepted as a stub. Real IdP bearer-token
auth is a planned follow-on.
Access control#
All enterprise endpoints require the org-operator role — the user must be an owner or admin in at least one workspace within the org. Non-operators receive 403.
Readiness model#
Enterprise auth readiness is dynamic, derived from actual org configuration:
| Readiness | Meaning |
|---|---|
| Live today | Feature is enabled and operational |
| Planned | Architecture exists, implementation pending |