Access governance, tenant isolation, and emergency kill switches.
Immediately disable features across all tenant sessions in under 60 seconds (Propagation SLA: <60s via 20s revalidation loop).
Autonomous agent executions, LLM runs, and tool dispatches
Full-text search, vector retrieval, and memory indexing
Bulk data import, CSV ingestion, and schema migrations
Third-party services sync (Google, Microsoft, webhooks)
Public API endpoints and external bearer authentication
Active user sessions, bearer credential life-cycles, and Secret Manager bindings.
Immediate on 401/403 or manual revocation
Cookies set with SameSite=Lax, Max-Age=43200s (12h)
GCP Secret Manager (Rotated per J0-218)
Zero plaintext keys committed; isolated per tier
Issue scoped Personal Access Tokens (PATs) or store encrypted Bring-Your-Own-Key (BYOK) provider credentials isolated to your user and tenant boundary.
| Name | Masked Key | Tier / Provider | Scopes | Last Used | Actions |
|---|---|---|---|---|---|
| No active tokens in vault. Issue a Personal Access Token or BYOK key above. | |||||
Configure tenant-level Single Sign-On and directory group mapping for Mercer (Marsh McLennan), WTW, Aon, and enterprise workforces.
Endpoint: /api/v1/oauth/okta/authorize
SP Metadata: /api/v1/auth/saml/okta/metadata
Endpoint: /api/v1/oauth/entra/authorize
JWKS Discovery: login.microsoftonline.com
Users: /api/v1/scim/v2/Users
Groups (BU = RBAC): /api/v1/scim/v2/Groups