Identity, permissions and isolation

Open EPM verifies the OIDC token signature, issuer and audience and binds the principal to the issuer and subject. Native group grants use stable group IDs. The web and MCP entry points require their configured audiences. Google sign-in on this documentation site uses the separate Firebase discussion identity.

How authority is scoped

• Server Administrator. Operates the native identity directory and platform control plane. Application business-data access requires a scoped application grant.
• Workspace Administrator. Governs applications and delegated authority in the selected workspace. The operation contract determines which changes this role can make.
• Application Reader, Editor and Administrator. The server checks operation permission and any applicable dimensional policy in the selected application. A dimensional policy can narrow access by member even for a user with an application grant.

The fixed core rechecks current authority on protected effects. Durable and delegated work carries recorded authority and scope into publication. A previously admitted job or an older browser view therefore cannot establish current permission by itself.

Verify a grant or revoke

Use a distinct Reader identity. In the disposable application, the dimensional policy allowed PointA and the authorized read filtered PointB. After revoking the Reader's application grant, a fresh protected browser request returned 403. The Application and dimensional permissions guide shows the grant, policy, read and revoke sequence.