Explore Actors
Talk to expert
Recognize Identity
Identify who is requesting access. Verify through approved methods: password, passkey, social, federated, biometric.
Give customers access thatrespects identity, context, andauthority.
Design customer-facing access around who is signing in,
what application or organization they belong to, what
actions are allowed, and what happens when trust changes.
Identity, authentication & recovery
Verify Session
Establish and protect the session. Challenge if risk signals arise. Support MFA and step-up authentication.
Recover Access
Support secure password reset, account recovery, and credential management. No single-method lock-out.
Choose what you need to govern
Consumer Sign-In
Individual customers create accounts and sign in. You control authentication method and session lifecycle.
Customer Org Access
Members of customer organizations access org-specific resources. Membership is not automatic permission.
Delegated Third- Party
Partners or agents act on behalf of a customer with scoped, bounded authority. Explicit mandate required.
Machine-Assisted Action
AI agents or workflows perform actions on behalf of customers. Scoped purpose and revocation required.
Authorization & access decisions
Access is decided at the time an action is requested, using the authorized actor, resource, policy, context and active mandate as applicable.
✅ Access Allowed
ACTOR[email protected] (Individual)
RESOURCEAcme Corp Marketing Plan
ACTIONRead, Comment
POLICYMarketing team members can read and comment
ORGANIZATIONAcme Corp (member, active)
REASONUser is active member with Marketing role
❌ Access Denied
ACTOR[email protected] (Individual)
RESOURCEAcme Corp Financial Records
ACTIONExport
POLICYOnly CFO and Auditor roles can export financials
ORGANIZATIONAcme Corp (member, Sales role)
REASONUser does not have required role (Sales ≠ Finance)
Delegated & on-behalf-of access
A third party or agent must have bounded authority for the particular action. Identity or account affiliation alone is insufficient.
Explicit Mandate
Agent has written authorization to act for specific resources and actions only
Scope Bounded
Authority limited to specific actions, time period, and purpose
Revocable Anytime
Principal can withdraw delegation immediately without friction
Auditable Decision
Every action logged with mandate reference and decision outcome
Organizations & context switching
Membership ≠ Permission
An individual may belong to one or more customer organizations, but membership alone is not blanket permission to access all resources.
Pending Invitation
Invited but not yet accepted
Active Member
Accepted and approved
Revoked / Expired
Access removed or time-limited ended
Continuous trust & session changes
A session may remain recognizable while the right to take an action changes as policy, authority or signals change.
1. Initial Access Granted
User signs in. Session established. Access granted for current role and policy.
2. Signal Change Detected
New information arrives: IP address changed, failed login attempt, organization policy updated, role revoked.
3. Policy Re-evaluated
System checks: Is this session still trusted? Does updated policy allow the action? Are new mandates valid?
4. Step-Up or Denial
System requires additional authentication, limits access, or denies the action. User never silently allowed to proceed.
5. Decision Recorded
Outcome logged with timestamp, reason, and evidence. Auditable trail of trust changes during session.
%20(1).png&w=3840&q=75)
Evidence & explainability
Decision Evidence Includes
- •Actor identity (who requested)
- •Requested action and resource
- •Active organization context
- •Applied policy & version
- •Authority/mandate status
- •Risk signals considered
- •Timestamp of decision
- •Outcome and reason
What We Don't Show
- •Fraud detection rules (avoid teaching attackers)
- •Internal risk scoring algorithms
- •Other users' access decisions
- •Unrelated organization data
- •Raw authentication factors
- •Sensitive backend system details
Architecture & integration
Work with existing customer applications and identity estates. Additional authority and evidence checks can be integrated where implemented.
REST API
Query policy, make access decisions, log evidence. Available and production-ready.
Webhooks
Real-time notifications on access changes, policy updates, or revocation events.
SDKs
JavaScript, Python, Node.js, Go. Simplify integration and decision embedding.
Interface concept showcase
Illustrative example — not a depiction of a current live dashboard.
Active OrganizationAcme Corp (Primary)
Actor Identity[email protected]
Account StatusActive Member
Last Login2 min ago from 192.168.1.100
Requested Action
Resource
Marketing Budget 2026
Action
Export
Policy
Marketing-Export-Policy v2.1
Decision
ALLOW
Reason: User is active member with Marketing role. Policy allows export for Marketing group members.
Developer & enterprise paths
For Product & Security Teams
Understand identity, authentication, authorization, and audit requirements. Design the access flow with your architecture and compliance constraints.
Talk to identity expert
For Builders & Engineers
Dive into APIs, SDKs, and integration patterns. Start with API reference docs or a sandbox environment for hands-on exploration.
View documentationPrivacy, safety & assurance
Data Protection
End-to-end encryption,
secure sessions, no
plaintext credentials
stored.
Privacy Design
Minimal data collection, no
cross-tenant leakage, user
consent respected.
Audit Trails
Immutable logs of all access,
decisions, and changes.
Compliance-ready.
Verified Claims
All security, compliance, and
certification claims backed by
evidence.
Frequently asked questions
Why is sign-in not the same as authorization?
Sign-in establishes who an actor is through verified authentication, while authorization evaluates whether that authenticated actor is permitted to perform a specific action on a specific resource under current organization context, policies, and mandates.
How do you handle multi-tenant access?
Zoiko iD treats organizational boundaries as explicit contexts. Users can belong to multiple customer organizations, but permissions and data scopes are evaluated strictly per active organization session without cross-tenant leakage.
What is delegated access?
Delegated access allows third-party partners, agents, or automated systems to act on behalf of a principal customer under an explicit, scoped mandate with bounded authority, revocable at any time.
Can access change during a session?
Yes. With continuous trust evaluation, changes in risk signals, policy updates, organization membership, or mandate revocations can trigger step-up authentication, reduced privileges, or immediate denial without terminating the recognizable session.
How does revocation work?
Revocation is immediate and propagated across decision points. When an organization admin, user, or automated trigger revokes a role or delegation mandate, subsequent access checks reflect the updated state in real time.
What evidence is available for audit?
Every access decision produces an immutable audit record containing actor identity, requested action and resource, active organization context, applied policy version, mandate status, risk signals, timestamp, and the final outcome with explainable rationale.
Design customer access built on
explainable trust
By submitting, you agree to our Privacy Policy. Your inquiry is not a service commitment.