Manage identities and access

Verify a user by issuer and subject, or a native group by stable group ID. A native identity permits authentication. Workspace roles, application roles, rule permissions and dimensional policy govern the work that identity can perform. A server Administrator needs a scoped grant to access application data.

Inspect before changing a grant

1. Inspect effective access. Read direct and group grants, verified membership, the active dimensional policy and applicable member tags. Page each required list. Report missing evidence before drawing a conclusion about effective access.
2. To grant a scoped application role, choose Reader, Editor or Administrator for the exact application and verified identity. Use the current revision where required, then read back the grant and committed receipt. The set_v2_application_access reference lists the application security contract.
3. To configure dimensional access, check the active policy and security revision. A direct assignment replaces the complete read and write tag maps. In the disposable example, the separately signed Reader sees PointA, the policy filters PointB, and a write is denied.

For delegated execution, inspect or revoke the exact delegation. Verify its version, principal, permitted operation, validity window and schedule binding when applicable. After a conflict, read the current version before preparing a new change. Use a separate authorized test identity to verify access outcomes.

Access prompt templates · Access tools · Native identities