Organization controls

Current status: planned organization feature track.

Identity and role separation

OIDC/SSO, organization membership, Installation/repository enrollment, and service identity scope operations. Separate permissions cover run, intervention, Connection administration, policy proposal/activation, capability approval, Capsule approval, export, and retention administration. Credential, policy, and Effect approval roles can be separated. An agent cannot activate its own policy or mint capability. Responsibility handoff identifies the accepted checkpoint and next action.

Governance operations

Connection inventory records ownership, scope, version history, health, rotation, disable, revocation, usage, budgets, and rate limits. Governance includes signed baselines, policy simulation, staged rollout, drift detection, scoped exceptions, retention, evidence export, quarantine, and emergency kill switches. Organization policy cannot weaken the local Security Floor.

Evidence binds requester, generation, Run, policy, approval, Connection version, operation, destination, and result; SIEM export retains the same causal contract. Customer-controlled execution, retention, storage, and keys are supported where required by the organization contract.

Example: a developer requests an exception, a separate authorized approver accepts its exact digest, and the request expires without becoming permanent blanket access.

See organization governance and policy hierarchy.