Access Level
Access resources granted by the group
Written by the system, not by the person making the change.
Know who can do what, and prove it.
Roles and policies you design once and attach deliberately, not inherit by copy. Effective access is computed rather than remembered, and every change lands in a log with the identity, the timestamp and the binding it replaced.
“Everyone is an admin” is not a policy.
Permissions that accumulate instead of being designed end the same way everywhere: nobody can say who can do what, or why.
Roles copied, never audited
New accounts inherit whatever the last person had, and a mover keeps the previous team's rights alongside the new ones. Broad access spreads by convenience and stays by inertia.
Roles are designed once and attached deliberately.
Permissions drift
One-off grants pile up until effective access is unknowable — the org chart and the permission graph stop matching.
Effective access is the union of policies you can read.
No way to test a policy
You find out a rule is wrong when someone is blocked mid-task — or worse, when someone isn't.
Simulate any identity against any action before it ships.
Least privilege you can actually administer.
Least privilege means minimum necessary in a hospital, segregation of duties in a bank and need-to-know in a ministry. The mechanism underneath is the same everywhere: policies you can read, resolved as a union, with deny winning.
Broader rights sit above narrower ones.
Tenant Owner, Group Owner, Group Admin, Group Member. Higher tiers inherit the scopes below them, so a grant means the same thing wherever you meet it.
Deny wins, wherever it comes from.
Effective access is the union of every attached policy, direct or inherited, and an explicit deny beats any allow above it.
Write the pattern once.
Role templates carry the statements a job actually needs, so nobody assembles a set of permissions by hand for the fifth time.
The answer an auditor asks for.
Every role, policy and binding change with the actor, the timestamp and the state it replaced, for any window you name.
Test a rule before anyone lives under it.
Put an identity against an action and a resource and read the verdict, with the policy that decided it named beside the answer.
Health checks before an assessor runs them.
A read-only pass over the tenant that flags what an assessor would flag: a tenant with a single owner, roles nobody holds, groups that loop back on themselves.
One console for the whole model.
Read the policy behind a role rather than its name, test it against a real identity before it ships, and see everything that changed since the last review.
The exact stamp, the full identity behind the change, and the difference between the binding before and the binding after. Removals that happen automatically at offboarding land on the same trail as anything a person did.
Test before you deploy.
Never guess what a policy does. Give the identity a role, point it at an action and a resource, and resolve the effective decision — the verdict follows the role, every time.
Governance that lets you say yes.
When effective access is computed rather than remembered, a request stops being a risk review. A team asks, you attach a policy you already wrote, and the simulator shows what it reaches before anyone lives under it. The usual reason to say no is that nobody can predict what a yes touches. That reason goes.
A new agent inherits a role you already designed: no fresh review, no new exception to remember at the next audit.
Who could reach this, on what date, and who granted it: one answer from the log, not three people trying to remember.
Group Owners run their own membership inside the ceiling you set, and every change they make still lands in your trail.
IAM, by the spec.
- Access model
- Role-based + Policy-based access control
- Hierarchy
- Tenant Owner · Group Owner · Admin · Member
- Resolution
- Union of policies; Deny overrides allow
- Templates
- Built-in reusable patterns
- Testing
- Simulate any identity against any action
- Audit
- Actor, timestamp and prior state on every change
- Isolation
- Strictly isolated per tenant
- Deployment
- On-prem · private cloud · air-gapped
- Compliance
- SOC 2 Type II · HIPAA · GDPR · ISO 27001
Hand the auditor the answer, not the access.
Roles, policies, bindings and every change to them sit in the same deployment as the work they govern. An assessor reads them where they are: nothing exported to a vendor first, no login handed over to settle a question.
These audits cover the system that holds the log, not a console you would have to take on trust.
See Exemplary AI in action
Book a demo and we'll show you purpose-built agents grounded in your own knowledge — deployed on your infrastructure.