Security & access
Roles, authentication, and controls that keep your workspace safe
A workspace layers several independent controls on top of each other: how someone proves who they are, what they're allowed to do once they're in, and a record of what happened afterwards. This section documents each layer.
The access-control surface
- Authentication — how a member proves their identity: a password, an OAuth provider, or your own identity provider through single sign-on.
- Authorization — roles and permissions decide what a signed-in member can do, enforced on every API call.
- Account hardening — two-factor authentication adds a second step to sign-in.
- Automated lifecycle — SCIM provisioning lets an identity provider create, update, and deactivate members automatically.
- Oversight — the audit log records who did what, and when.
- Change control — campaign approvals require a second reviewer before a send goes out.
Who this is for
Workspace admins and security teams deciding who gets access to a project, which safeguards to turn on, and how to review what happens once people are in.
In this section
| Page | Covers |
|---|---|
| Roles & permissions | Preset and custom roles, granular resource:action permissions |
| Two-factor authentication | TOTP and email-code verification at sign-in |
| Single sign-on | SAML and OIDC login through your identity provider |
| SCIM provisioning | Automated member lifecycle from your identity provider |
| Audit log | A record of who did what, and when |
| Campaign approvals | Four-eyes review before a campaign sends |
What's next
Head to Settings → Team & Roles to see who has access to your workspace today, then start with roles & permissions to shape what each of them can do.