[{"data":1,"prerenderedAt":969},["ShallowReactive",2],{"navigation":3,"\u002Fsecurity\u002Fidentity":250,"\u002Fsecurity\u002Fidentity-surround":964},[4,28,56,91,117,135,169,224],{"title":5,"path":6,"stem":7,"children":8,"icon":27},"Start here","\u002Fgetting-started","1.getting-started\u002F1.index",[9,11,15,19,23],{"title":10,"path":6,"stem":7},"Introduction",{"title":12,"path":13,"stem":14},"Decisions and open gates","\u002Fgetting-started\u002Fdecisions","1.getting-started\u002F2.decisions",{"title":16,"path":17,"stem":18},"Scope and non-goals","\u002Fgetting-started\u002Fscope","1.getting-started\u002F3.scope",{"title":20,"path":21,"stem":22},"Organization pilot","\u002Fgetting-started\u002Fpilot","1.getting-started\u002F4.pilot",{"title":24,"path":25,"stem":26},"Economics and quotas","\u002Fgetting-started\u002Feconomics","1.getting-started\u002F5.economics","i-lucide-compass",{"title":29,"path":30,"stem":31,"children":32,"icon":55},"Architecture","\u002Farchitecture","2.architecture\u002F1.index",[33,35,39,43,47,51],{"title":34,"path":30,"stem":31},"System architecture",{"title":36,"path":37,"stem":38},"Trust zones","\u002Farchitecture\u002Ftrust-zones","2.architecture\u002F2.trust-zones",{"title":40,"path":41,"stem":42},"Control plane","\u002Farchitecture\u002Fcontrol-plane","2.architecture\u002F3.control-plane",{"title":44,"path":45,"stem":46},"Organization tenancy","\u002Farchitecture\u002Ftenancy","2.architecture\u002F4.tenancy",{"title":48,"path":49,"stem":50},"Core data model","\u002Farchitecture\u002Fdata-model","2.architecture\u002F5.data-model",{"title":52,"path":53,"stem":54},"Codebase organization","\u002Farchitecture\u002Fcodebase","2.architecture\u002F6.codebase","i-lucide-layers",{"title":57,"icon":58,"path":59,"stem":60,"children":61,"page":90},"Identity and security","i-lucide-shield-check","\u002Fsecurity","3.security",[62,66,70,74,78,82,86],{"title":63,"path":64,"stem":65},"Identity and sessions","\u002Fsecurity\u002Fidentity","3.security\u002F1.identity",{"title":67,"path":68,"stem":69},"Domains and TLS","\u002Fsecurity\u002Fdomains","3.security\u002F2.domains",{"title":71,"path":72,"stem":73},"Ingress and egress","\u002Fsecurity\u002Fnetworking","3.security\u002F3.networking",{"title":75,"path":76,"stem":77},"Access policies and WAF-lite","\u002Fsecurity\u002Faccess-policies","3.security\u002F4.access-policies",{"title":79,"path":80,"stem":81},"Secrets and integrations","\u002Fsecurity\u002Fsecrets-integrations","3.security\u002F5.secrets-integrations",{"title":83,"path":84,"stem":85},"Governance and ownership","\u002Fsecurity\u002Fgovernance","3.security\u002F6.governance",{"title":87,"path":88,"stem":89},"Threat model","\u002Fsecurity\u002Fthreat-model","3.security\u002F7.threat-model",false,{"title":92,"icon":93,"path":94,"stem":95,"children":96,"page":90},"Building applications","i-lucide-code","\u002Fdevelopment","4.development",[97,101,105,109,113],{"title":98,"path":99,"stem":100},"AI and MCP","\u002Fdevelopment\u002Fai-mcp","4.development\u002F1.ai-mcp",{"title":102,"path":103,"stem":104},"Source control","\u002Fdevelopment\u002Fsource-control","4.development\u002F2.source-control",{"title":106,"path":107,"stem":108},"Sandboxed builds","\u002Fdevelopment\u002Fbuilds","4.development\u002F3.builds",{"title":110,"path":111,"stem":112},"Runtime contract and SDK","\u002Fdevelopment\u002Fruntime-contract","4.development\u002F4.runtime-contract",{"title":114,"path":115,"stem":116},"APIs and protocols","\u002Fdevelopment\u002Fapi","4.development\u002F5.api",{"title":118,"icon":119,"path":120,"stem":121,"children":122,"page":90},"Runtime and delivery","i-lucide-rocket","\u002Fdelivery","5.delivery",[123,127,131],{"title":124,"path":125,"stem":126},"Runtime clusters and previews","\u002Fdelivery\u002Fruntime-clusters","5.delivery\u002F1.runtime-clusters",{"title":128,"path":129,"stem":130},"Deployments and approvals","\u002Fdelivery\u002Fdeployments","5.delivery\u002F2.deployments",{"title":132,"path":133,"stem":134},"Databases and recovery","\u002Fdelivery\u002Fdata-recovery","5.delivery\u002F3.data-recovery",{"title":136,"icon":137,"path":138,"stem":139,"children":140,"page":90},"Operations","i-lucide-activity","\u002Foperations","6.operations",[141,145,149,153,157,161,165],{"title":142,"path":143,"stem":144},"Observability and audit","\u002Foperations\u002Fobservability","6.operations\u002F1.observability",{"title":146,"path":147,"stem":148},"Operating model","\u002Foperations\u002Foperating-model","6.operations\u002F2.operating-model",{"title":150,"path":151,"stem":152},"Deploy and roll back","\u002Foperations\u002Fdeploy-rollback","6.operations\u002F3.deploy-rollback",{"title":154,"path":155,"stem":156},"Back up and restore","\u002Foperations\u002Fbackup-restore","6.operations\u002F4.backup-restore",{"title":158,"path":159,"stem":160},"Upgrade and patch","\u002Foperations\u002Fupgrades","6.operations\u002F5.upgrades",{"title":162,"path":163,"stem":164},"Rotate keys and credentials","\u002Foperations\u002Fkey-rotation","6.operations\u002F6.key-rotation",{"title":166,"path":167,"stem":168},"Incidents and access revocation","\u002Foperations\u002Fincidents","6.operations\u002F7.incidents",{"title":170,"path":171,"stem":172,"children":173,"icon":223},"Implementation plan","\u002Froadmap","7.roadmap\u002F01.index",[174,175,179,183,187,191,195,199,203,207,211,215,219],{"title":170,"path":171,"stem":172},{"title":176,"path":177,"stem":178},"Phase 0: architecture spikes and ADRs","\u002Froadmap\u002Fphase-0","7.roadmap\u002F02.phase-0",{"title":180,"path":181,"stem":182},"Phase 1: control-plane foundation","\u002Froadmap\u002Fphase-1","7.roadmap\u002F03.phase-1",{"title":184,"path":185,"stem":186},"Phase 2: managed source and change sets","\u002Froadmap\u002Fphase-2","7.roadmap\u002F04.phase-2",{"title":188,"path":189,"stem":190},"Phase 3: sandboxed build system","\u002Froadmap\u002Fphase-3","7.roadmap\u002F05.phase-3",{"title":192,"path":193,"stem":194},"Phase 4: runtime and data plane","\u002Froadmap\u002Fphase-4","7.roadmap\u002F06.phase-4",{"title":196,"path":197,"stem":198},"Phase 5: deployment, preview, migration, and recovery","\u002Froadmap\u002Fphase-5","7.roadmap\u002F07.phase-5",{"title":200,"path":201,"stem":202},"Phase 6: Entra identity and security policy","\u002Froadmap\u002Fphase-6","7.roadmap\u002F08.phase-6",{"title":204,"path":205,"stem":206},"Phase 7: MCP and AI-native workflow","\u002Froadmap\u002Fphase-7","7.roadmap\u002F09.phase-7",{"title":208,"path":209,"stem":210},"Phase 8: Pilot hardening","\u002Froadmap\u002Fphase-8","7.roadmap\u002F10.phase-8",{"title":212,"path":213,"stem":214},"Phase 9: developer hybrid and v1 GA","\u002Froadmap\u002Fphase-9","7.roadmap\u002F11.phase-9",{"title":216,"path":217,"stem":218},"Test strategy","\u002Froadmap\u002Ftesting","7.roadmap\u002F12.testing",{"title":220,"path":221,"stem":222},"Definition of done","\u002Froadmap\u002Fdefinition-of-done","7.roadmap\u002F13.definition-of-done","i-lucide-list-checks",{"title":225,"icon":226,"path":227,"stem":228,"children":229,"page":90},"Reference","i-lucide-book-open","\u002Freference","8.reference",[230,234,238,242,246],{"title":231,"path":232,"stem":233},"Plan coverage","\u002Freference\u002Fplan-coverage","8.reference\u002F1.plan-coverage",{"title":235,"path":236,"stem":237},"Decision register","\u002Freference\u002Fdecisions","8.reference\u002F2.decisions",{"title":239,"path":240,"stem":241},"Glossary","\u002Freference\u002Fglossary","8.reference\u002F3.glossary",{"title":243,"path":244,"stem":245},"Sources","\u002Freference\u002Fsources","8.reference\u002F4.sources",{"title":247,"path":248,"stem":249},"Contributing and docs access","\u002Freference\u002Fcontributing","8.reference\u002F5.contributing",{"id":251,"title":63,"body":252,"description":957,"extension":958,"links":959,"meta":960,"navigation":961,"path":64,"seo":962,"stem":65,"__hash__":963},"docs\u002F3.security\u002F1.identity.md",{"type":253,"value":254,"toc":944},"minimark",[255,271,276,279,282,293,302,306,309,312,349,352,358,361,364,368,371,386,394,397,403,407,410,413,433,436,440,443,446,452,455,475,483,486,506,510,513,516,536,539,543,546,552,555,561,564,567,571,574,577,792,799,802,833,836,858,862,865,871,874,879,882,888,891,895,898,901,924,928,940],[256,257,258],"note",{},[259,260,261,265,266,270],"p",{},[262,263,264],"strong",{},"v1 design baseline."," This page specifies intended behavior. Delivery and validation are tracked in the ",[267,268,269],"a",{"href":171},"implementation plan","; it is not a claim that the platform is already implemented.",[272,273,275],"h2",{"id":274},"intrnl-is-the-identity-broker","intrnl is the identity broker",[259,277,278],{},"Each organization configures Entra once.",[259,280,281],{},"Hosted applications do not each receive a separate Entra integration, client secret, redirect URI, or raw Microsoft token.",[283,284,290],"pre",{"className":285,"code":287,"language":288,"meta":289},[286],"language-text","Microsoft Entra ID\n        ↓\nintrnl identity broker\n        ↓\nnormalized intrnl identity\n        ↓\nconsole, MCP and hosted apps\n","text","",[291,292,287],"code",{"__ignoreMap":289},[259,294,295,296],{},"Microsoft’s identity platform supports OIDC-based SSO using tenant-scoped endpoints and signed ID tokens, making OIDC the initial identity integration for the pilot. ",[267,297,301],{"href":298,"rel":299},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fidentity-platform\u002Fv2-protocols-oidc",[300],"nofollow","Microsoft Entra OIDC",[272,303,305],{"id":304},"organization-entra-configuration","Organization Entra configuration",[259,307,308],{},"Use a single-tenant Entra application\u002Fenterprise application for the pilot organization in intrnl.",[259,310,311],{},"Authentication flow:",[313,314,315,319,322,331,334,337,340,343,346],"ul",{},[316,317,318],"li",{},"Authorization Code flow",[316,320,321],{},"PKCE",[316,323,324,327,328],{},[291,325,326],{},"state"," and ",[291,329,330],{},"nonce",[316,332,333],{},"Tenant-specific issuer validation",[316,335,336],{},"Audience validation",[316,338,339],{},"Signature\u002FJWKS validation",[316,341,342],{},"Short authorization-code lifetime",[316,344,345],{},"Redirect allowlist",[316,347,348],{},"Rotated client secret or certificate credential",[259,350,351],{},"User identity is keyed by an immutable external identifier such as:",[283,353,356],{"className":354,"code":355,"language":288,"meta":289},[286],"provider_id\nentra_tenant_id (tid)\nentra_object_id (oid) or stable subject\n",[291,357,355],{"__ignoreMap":289},[259,359,360],{},"Never use email address as the primary identity key.",[259,362,363],{},"Email, display name, and department are mutable profile attributes.",[272,365,367],{"id":366},"group-and-role-handling","Group and role handling",[259,369,370],{},"For the pilot organization, prefer:",[372,373,374,377,380,383],"ol",{},[316,375,376],{},"Entra application roles for broad intrnl roles.",[316,378,379],{},"Groups assigned specifically to the intrnl enterprise application.",[316,381,382],{},"SCIM-managed group membership for complete lifecycle synchronization.",[316,384,385],{},"Microsoft Graph lookup only when genuinely needed.",[259,387,388,389],{},"Do not blindly emit every group in a user’s tenant. Entra can omit groups when token limits are exceeded; Microsoft documents limits of 200 groups for JWTs and 150 for SAML assertions and recommends application roles for new application authorization where appropriate. ",[267,390,393],{"href":391,"rel":392},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fsecurity\u002Fzero-trust\u002Fdevelop\u002Fconfigure-tokens-group-claims-app-roles",[300],"Microsoft group claims and app roles",[259,395,396],{},"Example mappings:",[283,398,401],{"className":399,"code":400,"language":288,"meta":289},[286],"Entra app role: Intrnl.Creator\n→ intrnl organization role: Creator\n\nEntra app role: Intrnl.SecurityAdmin\n→ intrnl organization role: Security Admin\n\nEntra group: SG-Intrnl-Operations-Pilot\n→ intrnl group: Operations Pilot\n",[291,402,400],{"__ignoreMap":289},[272,404,406],{"id":405},"jit-provisioning","JIT provisioning",[259,408,409],{},"V1 supports just-in-time provisioning.",[259,411,412],{},"On the first valid organization login:",[372,414,415,418,421,424,427,430],{},[316,416,417],{},"Validate the Entra identity.",[316,419,420],{},"Ensure the user is assigned to the enterprise application or approved group.",[316,422,423],{},"Create or update the intrnl user profile.",[316,425,426],{},"Create the organization membership.",[316,428,429],{},"Apply mapped roles\u002Fgroups.",[316,431,432],{},"Issue an intrnl session.",[259,434,435],{},"JIT makes the pilot simple without preloading every employee.",[272,437,439],{"id":438},"scim","SCIM",[259,441,442],{},"SCIM follows shortly after JIT and is part of the v1 enterprise architecture.",[259,444,445],{},"Implement:",[283,447,450],{"className":448,"code":449,"language":288,"meta":289},[286],"\u002Fscim\u002Fv2\u002FUsers\n\u002Fscim\u002Fv2\u002FGroups\n",[291,451,449],{"__ignoreMap":289},[259,453,454],{},"SCIM handles:",[313,456,457,460,463,466,469,472],{},[316,458,459],{},"User creation",[316,461,462],{},"Attribute updates",[316,464,465],{},"Activation\u002Fdeactivation",[316,467,468],{},"Group creation",[316,470,471],{},"Group membership changes",[316,473,474],{},"User and group deletion semantics",[259,476,477,478],{},"Microsoft Entra’s provisioning service can automate both provisioning and deprovisioning of users and groups through SCIM 2.0. ",[267,479,482],{"href":480,"rel":481},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fidentity\u002Fapp-provisioning\u002Fuse-scim-to-provision-users-and-groups",[300],"Microsoft Entra SCIM provisioning",[259,484,485],{},"When an organization deactivates a user:",[313,487,488,491,494,497,500,503],{},[316,489,490],{},"Disable the organization membership.",[316,492,493],{},"Revoke active console sessions.",[316,495,496],{},"Revoke MCP grants.",[316,498,499],{},"Disable direct Git access.",[316,501,502],{},"Reassign or flag owned applications.",[316,504,505],{},"Preserve their audit attribution.",[272,507,509],{"id":508},"platform-sessions","Platform sessions",[259,511,512],{},"After upstream SSO, intrnl issues its own short-lived session.",[259,514,515],{},"Benefits:",[313,517,518,521,524,527,530,533],{},[316,519,520],{},"Consistent sessions across IdPs",[316,522,523],{},"Central revocation",[316,525,526],{},"No raw Entra tokens in app runtimes",[316,528,529],{},"Easier multi-IdP support",[316,531,532],{},"Stable authorization model",[316,534,535],{},"Independent app-session lifetime",[259,537,538],{},"Refresh tokens or equivalent server-side session extensions should be rotated and revocable.",[272,540,542],{"id":541},"app-authentication-flow","App authentication flow",[259,544,545],{},"Applications use a gateway-managed, host-specific session:",[283,547,550],{"className":548,"code":549,"language":288,"meta":289},[286],"1. Browser requests equipment.example-org.\u003Cruntime-apex>\n2. Gateway sees no app session\n3. Browser redirects to auth.intrnl.cloud\n4. Auth broker uses the existing intrnl\u002FEntra session\n5. Broker returns a one-time signed code\n6. Runtime gateway establishes a host-only app session\n7. Gateway evaluates app access policy\n8. Request reaches workerd\n",[291,551,549],{"__ignoreMap":289},[259,553,554],{},"Use cookies with properties equivalent to:",[283,556,559],{"className":557,"code":558,"language":288,"meta":289},[286],"Secure\nHttpOnly\nPath=\u002F\nNo Domain attribute\n__Host- prefix\n",[291,560,558],{"__ignoreMap":289},[259,562,563],{},"The gateway reserves and strips intrnl session-cookie names from application responses.",[259,565,566],{},"Application code cannot create, replace, or inspect the gateway’s authentication cookie.",[272,568,570],{"id":569},"runtime-identity-assertion","Runtime identity assertion",[259,572,573],{},"The app does not receive the Entra token.",[259,575,576],{},"The gateway passes a short-lived, app-audience-bound assertion containing normalized identity:",[283,578,582],{"className":579,"code":580,"language":581,"meta":289,"style":289},"language-json shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","{\n  \"sub\": \"usr_01K...\",\n  \"org\": \"org_01K...\",\n  \"aud\": \"app_01K...\",\n  \"email\": \"user@example.com\",\n  \"display_name\": \"Jane Smith\",\n  \"groups\": [\"operations\"],\n  \"roles\": [\"member\"],\n  \"iat\": 1789958300,\n  \"exp\": 1789958360\n}\n","json",[291,583,584,593,621,642,663,684,705,730,753,771,786],{"__ignoreMap":289},[585,586,589],"span",{"class":587,"line":588},"line",1,[585,590,592],{"class":591},"sMK4o","{\n",[585,594,596,599,603,606,609,612,616,618],{"class":587,"line":595},2,[585,597,598],{"class":591},"  \"",[585,600,602],{"class":601},"spNyl","sub",[585,604,605],{"class":591},"\"",[585,607,608],{"class":591},":",[585,610,611],{"class":591}," \"",[585,613,615],{"class":614},"sfazB","usr_01K...",[585,617,605],{"class":591},[585,619,620],{"class":591},",\n",[585,622,624,626,629,631,633,635,638,640],{"class":587,"line":623},3,[585,625,598],{"class":591},[585,627,628],{"class":601},"org",[585,630,605],{"class":591},[585,632,608],{"class":591},[585,634,611],{"class":591},[585,636,637],{"class":614},"org_01K...",[585,639,605],{"class":591},[585,641,620],{"class":591},[585,643,645,647,650,652,654,656,659,661],{"class":587,"line":644},4,[585,646,598],{"class":591},[585,648,649],{"class":601},"aud",[585,651,605],{"class":591},[585,653,608],{"class":591},[585,655,611],{"class":591},[585,657,658],{"class":614},"app_01K...",[585,660,605],{"class":591},[585,662,620],{"class":591},[585,664,666,668,671,673,675,677,680,682],{"class":587,"line":665},5,[585,667,598],{"class":591},[585,669,670],{"class":601},"email",[585,672,605],{"class":591},[585,674,608],{"class":591},[585,676,611],{"class":591},[585,678,679],{"class":614},"user@example.com",[585,681,605],{"class":591},[585,683,620],{"class":591},[585,685,687,689,692,694,696,698,701,703],{"class":587,"line":686},6,[585,688,598],{"class":591},[585,690,691],{"class":601},"display_name",[585,693,605],{"class":591},[585,695,608],{"class":591},[585,697,611],{"class":591},[585,699,700],{"class":614},"Jane Smith",[585,702,605],{"class":591},[585,704,620],{"class":591},[585,706,708,710,713,715,717,720,722,725,727],{"class":587,"line":707},7,[585,709,598],{"class":591},[585,711,712],{"class":601},"groups",[585,714,605],{"class":591},[585,716,608],{"class":591},[585,718,719],{"class":591}," [",[585,721,605],{"class":591},[585,723,724],{"class":614},"operations",[585,726,605],{"class":591},[585,728,729],{"class":591},"],\n",[585,731,733,735,738,740,742,744,746,749,751],{"class":587,"line":732},8,[585,734,598],{"class":591},[585,736,737],{"class":601},"roles",[585,739,605],{"class":591},[585,741,608],{"class":591},[585,743,719],{"class":591},[585,745,605],{"class":591},[585,747,748],{"class":614},"member",[585,750,605],{"class":591},[585,752,729],{"class":591},[585,754,756,758,761,763,765,769],{"class":587,"line":755},9,[585,757,598],{"class":591},[585,759,760],{"class":601},"iat",[585,762,605],{"class":591},[585,764,608],{"class":591},[585,766,768],{"class":767},"sbssI"," 1789958300",[585,770,620],{"class":591},[585,772,774,776,779,781,783],{"class":587,"line":773},10,[585,775,598],{"class":591},[585,777,778],{"class":601},"exp",[585,780,605],{"class":591},[585,782,608],{"class":591},[585,784,785],{"class":767}," 1789958360\n",[585,787,789],{"class":587,"line":788},11,[585,790,791],{"class":591},"}\n",[259,793,794,795,798],{},"Inbound user-supplied ",[291,796,797],{},"X-Intrnl-*"," headers are always stripped.",[259,800,801],{},"The runtime adapter verifies the assertion and exposes:",[283,803,807],{"className":804,"code":805,"language":806,"meta":289,"style":289},"language-ts shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","const user = context.user;\n","ts",[291,808,809],{"__ignoreMap":289},[585,810,811,814,818,821,824,827,830],{"class":587,"line":588},[585,812,813],{"class":601},"const",[585,815,817],{"class":816},"sTEyZ"," user ",[585,819,820],{"class":591},"=",[585,822,823],{"class":816}," context",[585,825,826],{"class":591},".",[585,828,829],{"class":816},"user",[585,831,832],{"class":591},";\n",[259,834,835],{},"or in Nuxt:",[283,837,839],{"className":804,"code":838,"language":806,"meta":289,"style":289},"const user = useIntrnlUser();\n",[291,840,841],{"__ignoreMap":289},[585,842,843,845,847,849,853,856],{"class":587,"line":588},[585,844,813],{"class":601},[585,846,817],{"class":816},[585,848,820],{"class":591},[585,850,852],{"class":851},"s2Zo4"," useIntrnlUser",[585,854,855],{"class":816},"()",[585,857,832],{"class":591},[272,859,861],{"id":860},"platform-access-versus-application-authorization","Platform access versus application authorization",[259,863,864],{},"The gateway determines:",[866,867,868],"blockquote",{},[259,869,870],{},"May this person enter the app?",[259,872,873],{},"The application determines:",[866,875,876],{},[259,877,878],{},"What can this person do once inside?",[259,880,881],{},"For example:",[283,883,886],{"className":884,"code":885,"language":288,"meta":289},[286],"Gateway:\n- Organization member\n- Operations group\n- approved network\n\nApplication:\n- requester may create\n- manager may approve\n- finance may view cost\n",[291,887,885],{"__ignoreMap":289},[259,889,890],{},"Generated app templates must include clear application-level authorization patterns rather than assuming SSO alone protects every record.",[272,892,894],{"id":893},"break-glass-access","Break-glass access",[259,896,897],{},"Maintain a very small number of intrnl-native break-glass administrators.",[259,899,900],{},"Requirements:",[313,902,903,906,909,912,915,918,921],{},[316,904,905],{},"WebAuthn\u002Fpasskey MFA",[316,907,908],{},"No routine use",[316,910,911],{},"Separate recovery process",[316,913,914],{},"Highly visible audit events",[316,916,917],{},"Alerting on every login",[316,919,920],{},"Optional fixed-network restriction",[316,922,923],{},"Periodic access review",[272,925,927],{"id":926},"related-documentation","Related documentation",[313,929,930,935],{},[316,931,932],{},[267,933,934],{"href":84},"Governance",[316,936,937],{},[267,938,939],{"href":76},"Access policies",[941,942,943],"style",{},"html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sbssI, html code.shiki .sbssI{--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C}",{"title":289,"searchDepth":588,"depth":595,"links":945},[946,947,948,949,950,951,952,953,954,955,956],{"id":274,"depth":595,"text":275},{"id":304,"depth":595,"text":305},{"id":366,"depth":595,"text":367},{"id":405,"depth":595,"text":406},{"id":438,"depth":595,"text":439},{"id":508,"depth":595,"text":509},{"id":541,"depth":595,"text":542},{"id":569,"depth":595,"text":570},{"id":860,"depth":595,"text":861},{"id":893,"depth":595,"text":894},{"id":926,"depth":595,"text":927},"Entra OIDC, JIT, SCIM, normalized app identity, host-specific sessions, and break-glass access.","md",null,{},true,{"title":63,"description":957},"lIEwUZsY1XlKbUPeU-aO3og45UE6-NvoR0bn2ja08qw",[965,967],{"title":52,"path":53,"stem":54,"description":966,"children":-1},"The proposed platform monorepo, service boundaries, packages, and language allocation.",{"title":67,"path":68,"stem":69,"description":968,"children":-1},"Separate browser site boundaries for applications and the control plane, with wildcard TLS requirements.",1790019414382]