sys: partial — operators read-only via cf access · org sso net-new
access
blue is schematic linework, never decoration. all four planes are live today — the proposals on this station are below the diagram, not inside it.
sys: live — roster is cloudflare access — this surface only reads it
| operator | plane | power | source |
|---|---|---|---|
| operator@tridant.io | admin | full | cf access · github org tridant-io |
every operator past access holds full power. roles are proposed below. managed in cloudflare ↗
sys: net-new — stamped as a proposal — nothing enforces these
- owner
- everything — issue, revoke, publish, settings, keys
- support
- tickets, devices, seat release; read everywhere else
- billing
- orders, dunning, stripe links; no licence mutations
- read-only
- every station renders; no mutation control paints
sys: net-new — no sso_connections table, no idp round-trip, no enforcement
| organization | domain | idp | status | enforced |
|---|---|---|---|---|
| meridian exhibits | meridianexhibits.com | OIDC | verified | enforced |
| helios amusements | heliosamusements.com | SAML | pending | optional |
| northlight studio | northlightstudio.com | OIDC | disabled | optional |
add a connection
domain claim
- host
- _tridant.meridianexhibits.com
- type
- TXT
- value
- tridant-domain-verify=8f2c41d9a6b04e77
the claim proves the domain before any identity from it is trusted. one token per organization, checked on every connection test.
oidc discovery document or saml metadata — the idp decides which.
prototype only — nothing is contacted
sys: net-new — no such table exists — printed as a proposal
- sso_connections
- id · org_id · domain · idp · status · enforced · metadata_url · created_at