Skip to main content
We govern identity on two layers: the platform customers use, and Tess’s internal systems used to operate the service. In both cases, we apply least privilege — access only to what is needed, for only as long as needed.

​
On the platform (your organization)

  • Workspace administrators invite users and assign roles (what each person can view, create, or administer).
  • Enterprise plans can federate login to your company’s identity provider (SSO using industry standards), so authentication follows your corporate policy.
  • Sharing of agents, pages, and integrations respects configured permissions — reducing privileges or removing a user cuts the corresponding access.
  • Tess does not manage day-to-day membership of your workspace: who joins and who leaves is controlled by your organization’s administrators.

Roles and permissions

Role-based access control (RBAC) inside the workspace.

Corporate SSO

Available when contracted on the Enterprise plan.

Invite and removal

Organization administrators control the user lifecycle.

​
Inside Tess systems (internal operations)

  • Employees receive access only after authorization; role changes and offboarding trigger credential review and removal.
  • Critical systems require stronger authentication (including multi-factor).
  • Highly privileged accounts are limited in number, inventoried, and reviewed periodically.
  • Relevant administrative actions are logged for investigation and accountability.
Credentials, tokens, and Identity Provider security (when SSO is enabled) are a shared responsibility: Tess protects the platform; the customer protects their own accounts and IdP.