コンプライアンスと統制。Your sign-in, your roles, your audit trail.
ITおよびコンプライアンスのレビュー担当者が確認する項目：サインイン方法、どのエージェントを誰が実行できるか、どのアクションが人の承認を待つか、何が記録されるか。
- SAML 2.0 single sign-onYour identity providerConnected
- Domainarcadia.exampleVerified
- Enforce SSO for this domainOther ways to sign in stop workingOn
- Directory sync (SCIM 2.0)Members and groupsSyncing
People sign in through your identity provider. Enforce it, and no other way in works for your domain.
会社全体で1つのアカウント。 Owners and admins set it up in Account settings.
IT が求める 4 つのポイント。 Each one ships in the product.
Your identity providerPeople sign in the way they already do.
- SAML 2.0 single sign-on
- SCIM 2.0 directory sync
- Enforce SSO for your domain
Your roles and groups誰がどのプロジェクトを開き、どのエージェントを実行するか。
- Account and project roles
- Groups and custom roles
- All agents, or only the ones you pick
Rules you setAgents ask before the actions you choose.
- Allow, Ask or Block per action
- Project rules no agent can loosen
- One approval per exact call
A record you keepEvery action, exported or streamed.
- Refusals recorded too
- CSV or JSONL export
- A signed webhook to your tools
仕組み。One topic at a time.
シングルサインオンとディレクトリ同期
People sign in with SAML 2.0 single sign-on. Enforce it, and other ways to sign in for your domain stop working.
SCIM 2.0 keeps members and groups in sync. Map an identity provider group to a Kortix group once.
- ディレクトリグループKortixグループ
arcadia-engEngineeringarcadia-supportSupportarcadia-fin財務
セキュリティレビューの準備が整いました。Run it where your policy says, and read every line.
Kortix Cloud
We run the platform and the cloud computers.
セルフホスト
The app, the API and the database on your server.
Your VPC or on-prem
A single-tenant deployment, scoped with us.
Open source
Read it, fork it, audit it.
SOC 2 Type I verified
GDPR operated. The security page has the full model.
コンプライアンスの疑問に、お答えします。From the code and the docs.
Anything else, write to the team.
Which identity providers work?
Sign-in uses SAML 2.0. Directory sync uses SCIM 2.0 and covers the request patterns Okta and Microsoft Entra ID use. Both need a team account, not the personal account Kortix creates at sign-up.
What happens when someone leaves the company?
Remove them in your identity provider. Directory sync removes them from Kortix, and they lose access to every project.
Does an agent act with the role of the person who runs it?
No. An agent acts as itself, with only the access its block in kortix.yaml grants. It cannot give itself a permission it does not hold.
Do agents ask for approval by default?
No. Approval rules are off until you set them. Mark an action Ask, or mark a whole connector sensitive, and those calls wait for a person.
How long is the audit log kept?
Events stay readable for 90 days. Events from 90 to 365 days old sit in a locked archive that nobody can shorten or delete, and you can export them.
Can admins open every session?
Only if an account owner turns on session oversight. It is off by default. Each change to it is recorded, and so is each session read that only oversight allowed.
What happens if our Enterprise contract ends?
Single sign-on and directory sync stay on for 14 days, so nobody is locked out.
Which certifications does Kortix hold?
SOC 2 Type I verified. GDPR is a posture we run, not a certificate.
Do these controls work on a self-hosted instance?
Yes. On a self-hosted instance, Enterprise turns them on for every account.