Directory sync
Your directory stays the source of truth
People and groups sync from Entra ID, Active Directory or SCIM, and groups map to Cortx roles, so access follows the changes your identity team already makes.
Capability 02 · Governed Access
Access that follows the person, all the way down
Cortx knows who a person is, what they may do, and what an agent acting for them may do. It syncs people and groups from your directory, signs them in, resolves their roles into permissions, shares individual objects with them, and carries that identity through each hop an agent makes, down to Jira, Microsoft 365 or the database it reads.
Access ManagementManage roles, permissions and access control across the Cortx platform.
Create New
2Identity providers
19User groups
148Roles
226Permission sets
61Users
From your directory to every system an agent touches
People and groups come in from the directory you already run. Agents reach your systems through one governed MCP gateway and Cortx connectors.
Where identity comes from
Entra IDSynced through Microsoft Graph, sign-in with MSAL
Active DirectoryLDAP bind for sync, LDAP SSO for sign-in
CyberArkSign-in through your existing setup
SCIM 2.0Pushed from your provisioning, such as Entra
Cortx loginFor people outside your directory
Governed Access
Where it reaches
JiraProjects and issues
Microsoft 365Mail, files and Teams through Graph
DatabasesSnowflake, Azure SQL, Postgres
MCP serversStdio and remote, through the MCP gateway
Shared objectsDocuments and records shared with named people
Authority only narrows
as it moves down the chain.
The credential that reaches Jira, Microsoft 365 or a database should carry no more than what the person holds, intersected with what the agent is allowed and what the task asked for, and it should name both the person and the agent.
Where access lands
Jiraprojects, issues
Microsoft 365mail, files, Teams
DatabasesSnowflake, SQL, Postgres
MCP serversthrough the gateway
Cortx agentsand their tools
Shared objectswith named people
Four steps carry a person's identity from the directory to every system an agent touches. Select a step to jump to it.
01 · Know
People and groups come from your directory: Entra ID through Microsoft Graph, Active Directory and LDAP through a bind account, or SCIM 2.0 push. Groups map to Cortx roles.
02 · Sign in
People sign in with Entra ID, CyberArk, LDAP SSO or a Cortx login in the web app, and with OAuth and PKCE at the edge gateway. Every session is a signed token.
03 · Authorize
Native role-based access: permissions roll up into permission sets, roles and groups. Individual documents and objects can be shared with named people.
04 · Delegate
An agent acts for a person, under that person's permissions. With token exchange at the edge gateway, its credential narrows further, to what the agent is allowed and the task asked for, and names both.
Five links, each may only narrow
Each hop may drop authority and may never add it. A hop that cannot narrow should refuse, not pass through.
- 1 Person
- 2 Session
- 3 Agent
- 4 Tool
- 5 Downstream system
Your directory, your roles,
one gateway to your systems.
Role-based and document-level
Roles for the broad strokes, sharing for the exceptions
Permissions roll up into permission sets, roles and groups. When one document or record needs different access, it is shared with named people, without a new role.
Governed MCP gateway
One gateway to Jira, Microsoft 365 and your databases
Agents reach tools through one MCP gateway that runs stdio and remote MCP servers. Every server is connected, monitored and audited in MCP Factory.
Access your security team
can sign off on
How identity holds as a request moves from a person to the system an agent touches.
Sign in the way you already do
Entra ID, CyberArk, LDAP SSO or a Cortx login in the web app, and OAuth with PKCE at the edge gateway. No new identity store to run.
Zero-trust enforcement
No request is trusted for where it comes from. Each one is checked against the person's verified identity and permissions.
Every MCP server on the record
MCP servers are connected, monitored and audited in one place, so you can see which tools agents can reach and who added them.
How narrowing works
Agent calls run under the person's own permissions. Narrowing each call further, to what the agent is allowed and the task asked for, uses token exchange at the edge gateway, which you switch on per deployment.
See access follow the person.
We'll connect a test directory and walk one request from sign-in to Jira, on a scenario that looks like your firm.