Identity & access management
Access control for people who negotiate before they connect. Every permission scoped, time-boxed, continuously affirmed, and revocable in under a millisecond — no ticket, no approver, no explaining yourself.
- <1ms
- global revocation propagation, p99
- 0
- reason fields on the revocation endpoint
- 100%
- of hard limits survive an admin override attempt
- 21
- kink scopes in the catalogue, 3 of them critical-risk
$ iamsec session open --partner b-4417✓ policy/8f21 signed 6 scopes · 90m window✓ affirmation:verbal fresh · 12s ago✓ affirmation:written fresh · 4d ago✓ monitor:attached dm-02 · read_write_emergency→ session sess_01jd9 issued expires 23:41$ iamsec consent withdraw --me✓ revoked sess_01jd9 0.6ms · reason: not required✓ 6 grants cleared 0 inherited scopes survived✓ aftercare:sla_opened 6h · p95 4m$ iamsec limit declare body:spine --type hard⊘ policy.deny installed immutable · admin_exempt=false · overridable=falseDeployed in 4,200 dungeons · 11 poly homes · one very confused bank CISO
What we actually shipped
Six controls enterprise security has been quietly borrowing for a decade.
The vocabulary of ongoing, revocable, enthusiastic consent was worked out decades ago by people with far less margin for ambiguity than a distributed system has. We wrote down their design and gave it an API.
Hard limits are not a setting
An explicit deny that no role, no API key, no superuser console and no support ticket can override. We published the proof of it, because 'trust our defaults' is not an architecture.
Multi-Factor Affirmation
Something you know, something you want, and something you say out loud. Enthusiasm is a factor, not a vibe — and it expires, so it has to be re-collected, not remembered.
Continuous authorization
Consent is not a checkbox accepted once at install. Heartbeat check-ins run on an interval you set; a missed check-in revokes the session before anyone has to find the words.
The safeword is the root credential
One string, scoped to absolutely everything, resolvable by any party in the exchange. It propagates globally in under a millisecond and kills every active token in every region.
Revocation requires no reason
POST /v4/revocations has no reason field. Not undocumented — absent from the schema. Auditors get who and when. Nobody, including us, gets why.
Aftercare is on an SLA
Every closed session opens a support window with a measured p95 response time. Unmet aftercare is classified as an availability incident, because that is what it is.
Defense in depth
A circle of trust, inside a square of accountability.
The circle is what two people actually agree to: bounded scope, re-collected on an interval, shrinking the moment anyone says the word. The square is what makes that agreement survive a bad night: immutable denies, two signatures, an append-only record and an expiry that fires whether or not anyone remembers. Neither layer carries weight alone. Watch the envelope close.
back of the pack: Single use · Quick deploy · Always ready · Ultra-thin client · One size fits all roles · Leak-proof · Tested to ISO 27001 · Do not reuse. Same as passwords · Store in a cool, dry key vault · Check expiry before every session · If irritation persists, revoke
01 · circle of trust
What a counterparty is permitted to do, inside the granted envelope. It widens only by amendment, narrows on a missed check-in, and is never load-bearing on its own.
02 · square of accountability
The envelope the circle sits in: hard limits evaluated before any allow, signatures from both subjects, and an audit stream nobody with write access can edit.
03 · the seal
Both layers closed, lot and expiry printed on the outside, single use, quick to deploy and always ready. Protection that does not depend on anyone's good intentions is the only kind worth shipping.
Global propagation
No means no. In every region. In every language.
Say it once in Ljubljana and every edge repeats it in its own language, in under a millisecond, with no ticket queue and no cache TTL. Then Ljubljana checks in on everyone. Revocation is instant. Aftercare takes as long as it takes.
Success stories
Happy customers. Enthusiastically, explicitly, and on the record.
Every quote below was affirmed in writing and can be withdrawn at any time. Several were.
Velvet Trust
From 1am text threads to a signed policy with an appendix.
“We used to negotiate by text at 1am and remember it as vibes. Now it's a signed policy document with an appendix. Scene count is down twenty percent. Incidents are down one hundred.”
Head of trust, Velvet Trust
Private members' club · 400 seats
- −100%
- incidents
- −20%
- scene count, and nobody minds
- 1
- appendix, lovingly maintained
$ iamsec customer show velvet-trust
✓ policy signed · affirmations fresh
✓ hard limits: compiled, untouched
✓ aftercare SLA: met
· would recommend: yes (enthusiastically)
auto-advancing · hover to pause · swipe or use ← →
Say the quiet part into the policy document.
Five minutes to a signed scope set. No sales call, no onboarding workshop, and no configuration that survives a safeword.