Security & policy

Turn administrative intent into a versioned policy—with a clear enforcement boundary.

Published revision 12

Organization baseline

Access policy

Preview changes before publishing a new demo revision.

Maximum session durationMetadata for a future identity-provider session policy.Contractor access windowMaximum duration for new direct approvals.

Contractor duration is checked by the demo approval logic. Session duration is metadata only: no real sessions, SSO, or identity provider are connected.

Revision 12 · no unsaved changes

Enforcement responsibility

Designed for a future service boundary

Platform

Who may enter

Organization, membership, team scope, time-bound grants, and review evidence.

Identity provider · deferred

Who is signed in

Authentication, real sessions, MFA, SSO, and revocation delivery.

Independent products

What they may do

Product-specific roles, business data, operations, and retention remain isolated.