Identity provider (SSO)

1. Exchange SAML metadata or OIDC discovery documents.
2. Map directory groups -> platform roles (group-based, not user-based).
3. Enforce SCIM provisioning where your IdP supports it, so deprovisioning is automatic.
4. Test with a pilot group, then cut over.

Refer to the SSO + SAML setup article for the

step-by-step and IdP-specific notes (Okta, Azure AD / Entra ID, Keycloak).

Connectors & outbound integrations

When adding any integration:

1. Create a dedicated service identity - never reuse a human account.
2. Scope credentials to the minimum the integration needs (read-only where possible).
3. Store secrets in the vault; reference, never inline.
4. Set a rotation schedule and a kill switch.
5. Log the integration in the asset and third-party registers.

Egress & data-flow rules

• Default-deny egress; allow only the hosts you have documented.
• Any flow touching personal data needs a PDPL review before go-live.
• Prefer signed webhooks; validate signatures and reject replays.

the blast radius before you enable it.