Identity and Access

Identity and access define who is acting, which workspace they are acting in, and what resources they can use. SOIT resolves tenant, user, and workspace context before any business service executes.

The scoping model

SOIT identity is organized in three levels:

• Tenant — the top-level account. Plugins and secrets are tenant-scoped.
• Workspace — the working context under a tenant. Agents, workflows, knowledge, threads, and runs are all workspace-scoped.
• User — authenticated members with a role per tenant and per workspace: Owner, Admin, Dev, or Viewer.

Every workspace-scoped table carries tenant_id + workspace_id, and every workspace query is filtered by both — isolation is a schema-level property, not an application convention.

How a request is authorized

1. Authentication resolves tenant_id and user_id from the JWT or session; workspace_id comes from the request header or path.
2. Membership and role checks build a RequestContext — business APIs never accept tenant or workspace ids as free parameters.
3. Services enforce resource-level permissions through RBAC guards (create | read | update | delete | run per resource type) and workspace-level guards (read | write | owner | admin).
4. Scope-aware repositories apply the tenant/workspace filter on every query.
5. Audit and trace records keep identity attached to runtime behavior — every run knows who initiated it.

Cross-tenant and cross-workspace access attempts return 403/404, and tests for this are part of the mandatory backend test bar.

How it connects

• Every capability page in this section assumes this scoping — agents, knowledge, runs, and secrets are all resolved within the request's workspace.
• Secrets and Security builds egress and secret policy on top of the same context.
• Observe audit records show which identity performed each privileged operation.

API and UI surfaces

• API prefix: /api/v1 identity routes (auth, tenants, workspaces, users, membership)
• Related prefixes: /api/v1/security, /api/v1/secrets
• Web routes: /auth (sign-in), /setting, /system