合规与管控。Your sign-in, your roles, your audit trail.
IT 和合规审查人员会问的问题：用户如何登录、谁可以运行哪个 agent、哪些操作需要等待人工确认，以及会记录哪些内容。
- SAML 2.0 single sign-onYour identity providerConnected
- Domainarcadia.exampleVerified
- Enforce SSO for this domainOther ways to sign in stop workingOn
- Directory sync (SCIM 2.0)Members and groupsSyncing
People sign in through your identity provider. Enforce it, and no other way in works for your domain.
整个公司共用一个账户。 Owners and admins set it up in Account settings.
IT 部门提出的四项要求。 Each one ships in the product.
Your identity providerPeople sign in the way they already do.
- SAML 2.0 single sign-on
- SCIM 2.0 directory sync
- Enforce SSO for your domain
Your roles and groups谁打开哪个项目，以及运行哪个代理。
- Account and project roles
- Groups and custom roles
- All agents, or only the ones you pick
Rules you setAgents ask before the actions you choose.
- Allow, Ask or Block per action
- Project rules no agent can loosen
- One approval per exact call
A record you keepEvery action, exported or streamed.
- Refusals recorded too
- CSV or JSONL export
- A signed webhook to your tools
工作原理。One topic at a time.
单点登录和目录同步
People sign in with SAML 2.0 single sign-on. Enforce it, and other ways to sign in for your domain stop working.
SCIM 2.0 keeps members and groups in sync. Map an identity provider group to a Kortix group once.
- 目录组Kortix 组
arcadia-engEngineeringarcadia-supportSupportarcadia-fin财务
已准备好进行安全审查。Run it where your policy says, and read every line.
Kortix Cloud
We run the platform and the cloud computers.
自托管
The app, the API and the database on your server.
Your VPC or on-prem
A single-tenant deployment, scoped with us.
Open source
Read it, fork it, audit it.
SOC 2 Type I verified
GDPR operated. The security page has the full model.
合规问题，一一解答。From the code and the docs.
Anything else, write to the team.
Which identity providers work?
Sign-in uses SAML 2.0. Directory sync uses SCIM 2.0 and covers the request patterns Okta and Microsoft Entra ID use. Both need a team account, not the personal account Kortix creates at sign-up.
What happens when someone leaves the company?
Remove them in your identity provider. Directory sync removes them from Kortix, and they lose access to every project.
Does an agent act with the role of the person who runs it?
No. An agent acts as itself, with only the access its block in kortix.yaml grants. It cannot give itself a permission it does not hold.
Do agents ask for approval by default?
No. Approval rules are off until you set them. Mark an action Ask, or mark a whole connector sensitive, and those calls wait for a person.
How long is the audit log kept?
Events stay readable for 90 days. Events from 90 to 365 days old sit in a locked archive that nobody can shorten or delete, and you can export them.
Can admins open every session?
Only if an account owner turns on session oversight. It is off by default. Each change to it is recorded, and so is each session read that only oversight allowed.
What happens if our Enterprise contract ends?
Single sign-on and directory sync stay on for 14 days, so nobody is locked out.
Which certifications does Kortix hold?
SOC 2 Type I verified. GDPR is a posture we run, not a certificate.
Do these controls work on a self-hosted instance?
Yes. On a self-hosted instance, Enterprise turns them on for every account.