The problem
Large enterprises need one knowledge platform without automatically exposing every document to every team or maintaining a separate manual account spreadsheet.
What EKOS does
Verified credentials establish tenant and actor context, server-side queries apply organization and corpus visibility, and a SCIM service-provider surface manages users, groups, and soft deactivation.
- Tenant-wide and organization-scoped visibility
- Verified credential-derived identity context
- SCIM user and group provisioning
- Directory group-to-role mapping
- Soft deactivation that blocks later access
How it works
Verified JWT credentials establish the user and tenant; caller-supplied tenant or actor headers are never trusted.
An upstream identity provider provisions users and groups, updates memberships, and soft-deactivates people through the SCIM 2.0 surface.
EKOS administrators map directory groups to product roles and manage organization membership.
Server-side query paths scope every read to the tenant, the caller's organizations, and subscribed corpora.
Role and membership checks resolve against current identity records, so a deactivated user fails closed on the next request while past decisions stay attributable.
Business outcome
Knowledge access and product roles can follow the organization's current identity lifecycle while historical decisions remain attributable.
Proof and human control
Provisioning, role mapping, membership, and deactivation actions are evaluated against current identity records and retained in the audit trail.
Example in practice
An employee joins the Compliance directory group, receives the mapped role and organization access, then loses subsequent access after the upstream identity system deactivates the account.
Scope today
Current segmentation is enforced through verified request context and server-side application and query scoping.