Identity and access
Bring your identity provider. skaftorAI supports SSO and SAML for authentication and SCIM for provisioning, so access is granted and revoked from the systems you already run. Role-based access control governs who can plan, approve, execute, and deploy.
- SSO and SAML single sign-on
- SCIM provisioning and de-provisioning
- RBAC with least-privilege defaults
Auditability
Every meaningful action writes to an append-only log — who did what, when, and to which artifact. The record is not editable after the fact, so you can reconstruct exactly how any change moved from intent to production.
- Append-only, tamper-evident audit log
- End-to-end traceability across the pipeline
- Cost and usage visibility per team and run
Cloud connections without stored secrets
skaftorAI connects to Google Cloud using workload identity federation — no long-lived keys are stored on our side. Connections are keyless and scoped to the minimum access the work requires, so the blast radius of any credential is small by construction.
- Keyless cloud connect via workload identity federation
- No long-lived provider secrets stored
- Scoped, least-privilege access per connection