> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tess.im/llms.txt
> Use this file to discover all available pages before exploring further.

# Identity and Access

We govern identity on two layers: **the platform customers use**, and **Tess’s internal systems** used to operate the service. In both cases, we apply least privilege — access only to what is needed, for only as long as needed.

## On the platform (your organization)

* Workspace administrators invite users and assign roles (what each person can view, create, or administer).
* Enterprise plans can federate login to your company’s identity provider (SSO using industry standards), so authentication follows your corporate policy.
* Sharing of agents, pages, and integrations respects configured permissions — reducing privileges or removing a user cuts the corresponding access.
* **Tess does not manage day-to-day membership of your workspace:** who joins and who leaves is controlled by your organization’s administrators.

<CardGroup cols={3}>
  <Card title="Roles and permissions">
    Role-based access control (RBAC) inside the workspace.
  </Card>

  <Card title="Corporate SSO">
    Available when contracted on the Enterprise plan.
  </Card>

  <Card title="Invite and removal">
    Organization administrators control the user lifecycle.
  </Card>
</CardGroup>

## Inside Tess systems (internal operations)

* Employees receive access only after authorization; role changes and offboarding trigger credential review and removal.
* Critical systems require stronger authentication (including multi-factor).
* Highly privileged accounts are limited in number, inventoried, and reviewed periodically.
* Relevant administrative actions are logged for investigation and accountability.

<Warning>
  Credentials, tokens, and Identity Provider security (when SSO is enabled) are a shared responsibility: **Tess protects the platform**; **the customer protects their own accounts and IdP.**
</Warning>

## Related

* [Responsibilities](/Responsibilities)
* [Operations and Detection](/Operations-Detection)
* [Tess Commitments](/Tess-Commitments)