Identity & Access

Users, roles, teams and tenants. Part of the platform vertical. Legend: ✅ done · 🟡 in progress · ⬜ pending.

Checklist

✅ Tenants

Tenant directory with create, provision and delete; provisioning is idempotent and was verified live.

✅ Users

Principals directory plus invitations; creation is invitation-based — there is no direct principal write.

✅ Organizations

Full CRUD over organizations with the org-teams UI on top.

✅ Teams

Team CRUD and membership management; the session context carries the active team.

✅ Roles & permissions

Seeded built-in catalog (Owner, Administrator, Manager, Member, Auditor) with assignments, grants and an active-role switch.

✅ Sessions & devices

List, revoke, revoke-all, devices and step-up; revocation is self-service — an admin fleet view is a future item.

Evidence

All six features are built, registered by the authorize service and verified live against the droplet catalog: six iam_feature_definitions rows, all available.