CIAS · Identity & Access
Who may do what – governed in one place, traceable at every step.
Identity & Access steers the identity logic of your system: users, groups, roles, tenants and registration. Your identity provider signs people in – CIAS gives that sign-in its business meaning.
Capabilities at a glance
The module
Identity & Access
Nobody grants more rights than they hold themselves – and this rule cannot be switched off.
In many applications, authorisation is a collection of conditions spread across user interfaces and APIs. Identity & Access keeps it as a model of its own that you can review: who a person is in business terms, which tenant they belong to, which roles they hold – and who was allowed to give them those roles.
How CIAS is built into your system is decided during assembly in the Hub: tenant mode, registration paths, mails, audit and the sign-in levels for administration. The built system takes these settings into its configuration and then runs without the Hub.
Capabilities
What Identity & Access does in detail.
Every capability has its own page, describing what it does in business terms and what it takes care of day to day.
Users & groups
Every person has a business record with a clear status. Groups bundle roles across modules instead of handing them out one by one.
Learn moreRoles & permissions
Modules declare their own roles, CIAS governs who may grant them. Nobody grants more than they hold themselves.
Learn moreTenants
Every request runs under exactly one tenant, and CIAS checks before any module whether that tenant may be served.
Learn moreRegistration & invitation
One flow, several variants: self-registration, invitation and creation by administrators – each with confirmation and optional approval.
Learn moreSign-in & security
How strongly and how recently someone must have signed in is set per administration area – separately for reading and changing.
Learn moreIdentity provider
Your identity provider signs people in, CIAS gives the sign-in its meaning. Only one building block talks to the sign-in service.
Learn moreAudit & notifications
One audit trail for everything that happens to people, tenants and rights – and mails whose templates are clearly governed.
Learn moreWorking together
Working with Data Management and Reporting
Identity & Access answers who holds a right and who may grant it. What a right permits on the data – which model a role may read, which fields and which rows – is defined by the data model in Data Management. The two are linked only by the name of the role. That way there is no second copy of the permission model that drifts apart over time.
Before a request reaches a module, CIAS determines the requesting person, the tenant and the roles and attributes that apply. Data Management and Reporting rely on exactly this result: Reporting asks CIAS who is requesting a report and for which tenant. The CIAS audit records what happened to people, tenants and rights; the history in Data Management records what the data looked like. The acting person and the point in time connect the two.
CIAS runs embedded in your application or as a separate service alongside it. In business terms it behaves the same either way.
Other modules
Does CodamAI fit your engineering setup?
The most honest way to find out is a technical conversation: about your stack, your delivery and the requirements you have to evidence.