Administer users and permissions

Authentication is delegated to the identity provider; authorization belongs to the platform. Every one of the 186 API operations declares the permission it requires, the router registers each route with that declared permission, and a route with no declared permission fails a test rather than defaulting to open.

Human and machine identitiesPermalink to this section

Service accounts are distinct from user accounts, hold their own permissions, and are audited as machine actors. An integration running under a person's credentials makes every action it takes look like that person's, which is exactly what an audit trail exists to prevent.

Step-up authenticationPermalink to this section

Some actions require re-authentication at the moment they are taken, rather than relying on a session established hours earlier. Reading encrypted identifiers and administrative changes are the usual cases.