Sourced & Verified
Organizations don't self-assert. Third-party sources (government registries, domain registration, payment history) attest to attributes.
Auditable sources
Establish the
organization.
Verify relevant claims. Keep authority bounded and auditable. Scale identity across enterprises with transparent delegation.
What is organization identity?
A cryptographically verifiable representation of an organization: who it is, what claims it makes about itself, who is authorized to act on its behalf, and what those authorizations permit.
Separates identity (what you are), verification (what we can prove), representation (who speaks for you), and authority (what they're allowed to do).
Four objects in the model
Organization
Legal entity, business unit, or tenant. Persistent identity with attributes like name, jurisdiction, tax ID.
Verified Attributes
Claims about the org with evidence of who attested, when, and under what conditions. Expiry and revocation support.
Representation
Who is authorized to speak for the organization? Domain admin? Officer? Which org do they represent?
Authority
Scoped, bounded permissions. What can this person/service do? On which resources? For how long?
Verification & currentness
Time-Bound & Fresh
Verification has an "as-of" date. Attributes expire or are revoked. Never imply certainty beyond the evaluation time.
Always dated
Transparent Boundaries
What this doesn't cover. Geographic scope, legal jurisdictions, subsidiaries, parent relationships—all explicit.
Clear scope
Representation & roles
Who can act on behalf?
A job title, email domain, or admin role never automatically establish authority. Representation is explicit and bounded:
- Officer/ExecutiveAuthorized to make certain decisions on org's behalf
- Domain AdminCan add/remove members, manage accounts for this org
- DelegateGranted specific rights by an officer, time-limited
All relationships are time-bound and can be revoked at any time.
Authority graph & delegation
Organization → Officer → Delegate → Action
- OrganizationLegal entity
- OfficerRepresents org
- DelegateScoped grant
- ActionPermitted
Each link is auditable. Who granted? When? For what duration? What can they do?
Complex enterprise structures
Parent & Subsidiary
Hierarchical relationships between legal entities. Parent authority ≠ subsidiary authority; each has boundaries.
Multi-Tenant
Single organization may contain multiple tenants. Account structure decoupled from legal entity.
Geographic Scope
Authority may be limited to specific regions. Compliance, tax, and regulatory boundaries visible.
Team & Groups
Authority granted to teams. Team membership changes don't retroactively revoke past actions.
Audit Trail
Every delegation, approval, and revocation is recorded. Answers "who decided what, when?"
Expiry & Revocation
Authority is time-bound. Can be revoked immediately. Revocation doesn't change history.
Enterprise use cases
B2B Onboarding
Verify vendor organization, add authorized contacts, set approval workflows. All auditable and time-limited.
Enterprise
M&A & Transitions
Track organization changes. Migrate authority across entities. Maintain evidence of who had what when.
Enterprise
Compliance & Audit
Prove who was authorized to do what, when. Support regulatory inquiries with evidence trail.
Audit-ReadyIntegration & overlay-first design
APIs & SDKs
Verify organizations, manage delegation, query authority.
Webhooks
Real-time events on changes and revocations.
Authority Lookup
Query who can do what on your resources.
IdP Integration
Extend existing identity provider.
Policy Engines
Feed data to OPA, Styra for decisions.
Audit & SIEM
Stream events to your audit systems.
Developer adoption
Frequently asked questions
Find answers to common questions about Zoiko iD
What's the difference between representation and authority?
Representation is who is allowed to speak for an organization, such as an officer, a domain admin or a delegate. Authority is what that representative is permitted to do: scoped, bounded permissions on specific resources for a set period.
How are parent and subsidiary organizations handled?
They are modeled as separate legal entities in a hierarchy. Parent authority does not automatically become subsidiary authority; each entity has its own boundaries.
Can authority be revoked?
Yes. Authority is time-bound and can be revoked immediately. The revocation is recorded and does not change the history of past actions.
Does job title establish authority?
No. A job title, email domain or admin role never automatically establishes authority. Representation has to be explicit and bounded.
How long is organization identity verified?
Every verification carries an "as-of" date. Verified attributes expire or can be revoked, so a verification never implies certainty beyond the time it was evaluated.
Does this replace my IdP?
No. Organization identity is designed overlay-first: it extends your existing identity provider instead of replacing it.
Ready to establish organization identity?
Scale identity verification and authority management across your enterprise with transparent, auditable delegation.