B2B identity
for organization,
users, and delegated access

Design multi-organization access around distinct
organization identities, memberships, representatives, and bounded authority—without treating sign-in as permission.

Explore model

Talk to an expert

What is B2B / SaaS identity?

B2B / SaaS identity describes how a software provider represents customer
organizations, individual actors, their membership and context, and the authorization
required to access organization-specific resources.

Key distinction: Authentication establishes identity. Authorization must evaluate what the actor
may do within a particular organization. Sign-in is not permission.

Principal model: distinct relationships

People

Individual human. Can authenticate. Membership is not authority. Role determines permissions.

Organizations

Customer entity. Has members, representatives, and policies. Resource owner and policy enforcer.

Services

Non-human principal. Can authenticate via token. Represents
delegated authority and scoped purpose.

AI Agents

Sponsored non- human. Acts on behalf of organization or
person. Requires explicit mandate and bounds.

Relationship ≠ Permission. Being a member of an organization does not grant authority to act on its behalf.

Tenant boundary vs. organization identity

Tenant

An application data and administrative boundary. Every
customer SaaS instance has one.

Organization Identity

Represents the legal entity, partner, or actor within a
tenant. May have multiple orgs per tenant.

Key principle: A deployment may relate tenants to organization identities, but they are not interchangeable. This separation enables
isolated data, multi-organization access within a single tenant, and distinct governance per organization.

Membership lifecycle

1. Invite

Organization initiates
invitation. Email or
link sent to
candidate.

2. Accept

Invitee accepts.
Membership pending
approval or auto-
approved.

3. Approve

Admin approves.
Membership active.
Policies applied
based on role.

4. Active

Membership valid.
Access granted per
policy. Monitored for
changes.

5. Expire

Membership expires
at scheduled time.
Access revoked
automatically.

6. Revoke

Admin revokes
immediately. All
sessions terminated.
Logged.

Enterprise SSO & federation

Connect to existing IdP

Your customer's identity provider (Okta, Azure AD, Ping) remains
the source of truth. Zoiko iD receives authenticated identity
context and federation signals.

No user migration

Keep existing IdP, no data extraction

SAML, OAuth, OIDC

Supports all enterprise protocols

Org & role context passed

Identity + org claims inform decisions

Delegated authority model

1. Actor Identity

Who is making the request? Person, service, or agent with verified identity.

2. Organization Context

Which organization are they acting for? Is their membership current and approved?

3. Mandate & Scope

What is their explicit authority? Which resources and actions? Are there time or purpose limits?

4. Policy Evaluation

Apply organization policy. Apply network, time, and risk signals. Allow, deny, or require step-up.

5. Auditable Decision

Log the decision with reason, timestamp, and actor. Provide evidence for compliance and investigation.

❌ Membership alone never grants permission. A user is a member of org A but tries to access org B's data. The system evaluates who
they are (actor), what they're asking for (resource), their authority in that org (mandate), and org policy. Membership in org A is
irrelevant. Decision: deny.

Continuous trust & revocation

User Removed

Admin removes user from
org. Active sessions
revoked immediately.

Membership Expired

Time-limited membership
ends. Access automatically
denied next request.

Role Changed

User's role changes. New
permissions take effect.
Old permissions denied.

Breach Detected

Suspicious activity
flagged. Sessions
invalidated. Force re-auth
required.

Common B2B scenarios

Customer Org Access

Enterprise customers need admins
and team members to access their
org's data and resources.
Controlled invitation and role-
based access.

B2B Admin Delegation

Partner or manager needs to
manage a customer's account on
their behalf. Scoped, auditable,
time-limited authority.

Enterprise Federation

Customer's Okta or Azure AD drives
authentication. Zoiko iD adds
organization context and policy
enforcement.

Trust, privacy & governance

Data Isolation

Every tenant's organization data is isolated. No cross-tenant access or data leakage.

Privacy by Design

Minimize data collection. Respect user rights. Support data subject requests.

Least Privilege

Every grant is explicit. No default permissions. Scoped to resource, action, time and purpose.

Auditable Changes

Every membership, role, and policy change is logged. Immutable record for compliance.

Separation of Duties

Invite, approve, revoke—different roles can't unilaterally control access.

Evidence & Proof

Every decision carries evidence: who decided, when, with what policy, and why.

Frequently asked questions

Does B2B identity replace our identity provider?

No. Zoiko iD does not replace your customer's identity provider. Existing enterprise IdPs (such as Okta, Azure AD, or Ping) remain the authoritative source for authentication, while Zoiko iD adds organization context, membership lifecycle management, and policy-driven authority.

Is sign-in proof of permission?

No. Authentication establishes actor identity, but authorization evaluates what an actor is permitted to do within a specific organization context. Being an authenticated user or organization member does not automatically confer permissions to act on resources.

How are tenants isolated?

Tenants maintain strict application data and administrative boundaries. Organization identities exist within tenant boundaries with scoped access, preventing cross-tenant leakage and ensuring data segregation.

Can an organization revoke access?

Yes. Organization administrators can revoke membership, roles, or delegation mandates immediately. All active sessions associated with the revoked authority are terminated in real time and recorded in the audit log.

Can agents act on behalf of organizations?

Yes. AI agents and non-human services can act on behalf of customer organizations through explicit, scoped mandates with strict purpose, resource, and time boundaries.

How does this integrate with SCIM or SAML?

Zoiko iD integrates with standard enterprise protocols including SAML 2.0, OIDC, and SCIM for directory synchronization, enabling automated user provisioning, deprovisioning, and attribute synchronization from customer IdPs.

Bring organization identity into your platform.

Design multi-organization B2B access around clear identity, membership, authority,
and policy boundaries with auditable decisions.