RBAC & SSO

Pre-beta · last updated 2026-06-10

Pre-betaSSO and SCIM provisioning are planned for the Enterprise tier. Built-in RBAC is available to design partners today.

RBAC overview

Cendriix uses role-based access control (RBAC) to control who can create, view, approve, and cancel runs; who can register agents; and who can modify policies. RBAC is enforced at the API level — it cannot be bypassed by direct database access.

Roles are assigned to users at the workspace or team level. A user can have different roles in different teams within the same workspace.

Built-in roles

Role	Scope	Permissions
`owner`	Workspace	All permissions, including billing and workspace deletion
`admin`	Workspace	All permissions except billing. Can manage team roles.
`engineer`	Team	Create and cancel own runs. View all team runs. Register agents.
`approver`	Team	Approve and reject approval-gated steps. Read-only on runs they do not own.
`viewer`	Team	Read-only access to runs, audit logs, and cost reports.
`auditor`	Workspace	Read-only access to audit logs across all teams. Cannot view run outputs.

Custom roles

Enterprise workspaces can define custom roles using a permission manifest. Custom roles are additive — they grant specific permissions without inheriting a built-in role's full permission set.

yaml

# custom-role.yaml
id: deploy-approver
description: "Can approve deploy steps only; no other workflow permissions"
permissions:
  - runs.step.approve
    filter:
      agent: "deploy-canary"
  - runs.read

SSO / SAML

Enterprise workspaces can configure SAML 2.0 SSO. Once configured, users authenticate through your identity provider (Okta, Azure AD, Google Workspace). Cendriix does not store passwords for SSO-enabled workspaces.

SAML attribute mapping:

SAML attribute	Cendriix field
`email`	User email (required)
`given_name`	Display name
`groups`	Team membership (optional, used for auto-provisioning)
`cendriix_role`	Workspace role override (optional)

SCIM provisioning

Enterprise workspaces can use SCIM 2.0 to provision and deprovision users automatically when employees join or leave. Cendriix's SCIM endpoint is compatible with Okta, Azure AD, and JumpCloud.

RoadmapSCIM provisioning is planned for Q3 2026. Contact us if you need it for an active evaluation.