REGULATED SERVICES
Compliance-ready
identity and
delegated
authority for
regulated sectors.Compliance-ready identity
and delegated authority for
regulated sectors.
Govern identity, authorization, and evidence across regulated domains—finance, healthcare, government, energy. No unsupported claims. Clear audit trail. Policy-driven decisions.
Identity +
Authority + Evidence
for regulated work
Regulated Services is a compliance-first identity infrastructure for sectors with explicit authority, audit, and evidence requirements.
- Identity: Authenticate actors (humans, systems, agents) with verified credentials
- Authority: Define bounded delegation—scope, purpose, time, and revocation
- Evidence: Immutable audit trail linking actor → action → decision → resource
No compliance warranties: Architecture supports your organization's regulatory framework. Final compliance assessment remains your responsibility.
The regulated
sector challengeThe regulated sector challenge
Audit Gaps
Who did what, when, and under what authority? Traditional systems log events but hide the decision context. Regulators need evidence.
Authority Ambiguity
Role-based access (RBAC) grants permission. But who authorized the role? Can it be revoked instantly? Is there a time limit?
Policy Lag
Policies change (new regs, employee leaves). How do you revoke authority across all systems instantly, without breaking workflows?
Illustrative sector
scenarios
Illustrative sector scenarios
Financial Services: Transaction Authorization
Example (Illustrative): Wire transfer of $1M initiated. Who authorized it? Under what rules? Can it be stopped?
Actor Identity
Trader authentication verified [2FA, hardware key, behavioral signals]
Actor Identity
Trader authentication verified [2FA, hardware key, behavioral signals]
Authorization Mandate
Trader authorized by Risk Officer for transfers up to $5M, quarterly limit, daily review
Authorization Mandate
Trader authorized by Risk Officer for transfers up to $5M, quarterly limit, daily review
Policy Decision
Transfer is within mandate, under daily limit, no suspicious patterns. ALLOW.
Policy Decision
Transfer is within mandate, under daily limit, no suspicious patterns. ALLOW.
Audit Evidence
Immutable record: actor, mandate, decision context, timestamp, signature. Regulator can inspect.
Audit Evidence
Immutable record: actor, mandate, decision context, timestamp, signature. Regulator can inspect.
Actor identity &
verification
Actor identity & verification
Verified Credentials
Human identity verified through multiple factors (biometric, certificate, MFA). Non-repudiation required.
Session Context
When did authentication occur? From which location/device? Any anomalies? All tracked.
Non-Repudiation
Cryptographic proof links actor to action. Actor cannot later deny they performed it.
Organization, sponsor
& representationOrganization, sponsor & representation
Organizational Context
- •Who owns the resource being accessed? (e.g., Bank, Hospital, Agency)
- •What policies apply? (e.g., SOX, HIPAA, FedRAMP, NERC)
- •Who can grant authority? (e.g., Risk Officer, Chief Compliance Officer)
- •How long is authority retained? (e.g., Quarterly review, annual audit)
Sponsor Accountability
- •Who authorized this actor? (Named sponsor, with credentials)
- •For what purpose? (Business justification documented)
- •How long? (Expiry date set explicitly)
- •Revocable? (Yes, anytime, by sponsor or org policy)
Scoped authority
& delegation
Scoped authority & delegation
Scope Definition
Which resources? (e.g., Account 12345, Patient Records with Consent). What actions? (e.g., Read, Approve, Modify). Explicit boundaries set.
Purpose Statement
Why does the actor need this? (e.g., 'Process monthly invoices', 'Treat patient during appointment'). Business justification documented and audit-logged.
Time Bounds
Valid from–through dates. No indefinite access. Expiry enforced automatically. Extensions require re-approval, never automatic renewal.
Delegation Record
Documented in a signed mandate. Immutable. Includes actor identity, sponsor, scope, purpose, time, and approval chain.
No Implicit Authority: Role title (e.g., "Senior Analyst") does not automatically grant access. Authority must be explicitly delegated, documented, and time-limited.
Policy evaluation
& decision
Policy evaluation & decision
Verify Identity
Is the actor who they claim to be? Credential valid? Session not anomalous?
Check Mandate
Does this actor have a valid delegation for this action? Is it in scope? Still in effect?
Apply Policy
Organization policy (SOX, HIPAA, etc.). Any exceptions? Risk signals?
Render Decision
Allow, deny, or require step-up auth. Log immediately.
Continuous trust
evaluation
Continuous trust evaluation
Mandate Expiry
Time boundary reached. Access automatically revoked. No renewal without new approval.
Policy Change
Organization policy updated. All actors re-evaluated. Access denied if no longer compliant.
Risk Signal
Unusual activity detected. Actor flagged for immediate review or access blocked.
Revocation
Sponsor or org withdraws access immediately. Sessions terminated. No grace period.
Revocation &
exception handling
Revocation & exception handling
Revocation
Sponsor or org withdraws mandate immediately. Active sessions terminated. New requests denied. No delay.
Expiry
Mandate time boundary reached. Automatic enforcement. No extension without new approval. Audit event logged.
Indeterminate
Mandate status cannot be verified (service down, stale record). Default: deny. Actor can retry or escalate.
Audit evidence &
compliance trail
Every regulated action records:
Actor & Credentials
Who did it. Authentication method. Session context.
Mandate Reference
Which delegation was checked. Valid? In scope?
Action & Resource
What was done. On what. When.
Decision & Reason
Approved or denied. Policy evaluation trail.
Immutable Proof
Cryptographic signature. Cannot be altered. Regulator can verify.
Compliance-Ready: Evidence can be exported in compliance formats (for SOX audits, HIPAA inquiries, FedRAMP reviews, etc.). Retention policy controlled by your organization.
Enterprise
federation overlay
Enterprise federation overlay
Regulated organizations often have existing IdP infrastructure (Active Directory, LDAP, SAML). Zoiko iD overlays identity + authority + evidence without replacing your IdP.
Your IdP (Source of Truth)
- •Remains your identity authority (AD, Okta, Ping, etc.)
- •Owns user records, group membership, role assignments
- •Issues tokens, credentials, session certificates
- •No change required to existing deployments
Zoiko iD Authority Layer
- •Sits between IdP and resource layer
- •Adds explicit delegation (mandates, time bounds)
- •Enforces policy-driven access decisions
- •Logs authority decisions for audit
⚠ No IdP Replacement: Your existing identity infrastructure remains in place. Zoiko iD adds authority and evidence on top. This is an overlay model, not a replacement.
Security, privacy
& assurance
Security, privacy & assurance
Data Minimization
Only required data collected. No PII in audit logs. Encrypted at rest and in transit.
No Secrets in Logs
Credentials, tokens, API keys never logged. Only references and outcomes recorded.
Immediate Revocation
No delay. No grace period. When authority is withdrawn, it's gone instantly.
Compliance-Ready
Supports SOX, HIPAA, FedRAMP, NERC, and sector-specific audit requirements.
Personas &
implementation paths
Personas & implementation paths
Risk & Compliance
Understands regulation. Wants immutable audit trail. Can export evidence for auditors. Path: compliance assessment → deployment → audit reporting.
Engineering & IAM
Owns IdP, API layers, policy engine. Wants clear architecture + API docs. Path: API review → integration design → staged rollout.
Procurement & Executive
Evaluates vendor fit. Needs pricing, SLAs, legal terms. Path: RFI → compliance questionnaire → procurement process.
Frequently asked
questions
Frequently asked questions
Is this ISO/HIPAA-compliant? SOX-compliant? FedRAMP?
Zoiko iD architecture supports compliance requirements, but compliance assessment is your responsibility. We provide identity, bounded delegation, evidence export, policy enforcement to help you meet regulatory requirements. Consult your legal and compliance teams for final determinations.
Does this replace my existing IdP?
No. Zoiko iD functions as an authoritative overlay on top of your existing identity infrastructure (Active Directory, Okta, Ping, or SAML IdP). Your IdP continues authenticating actors and managing credentials, while Zoiko iD manages delegated authority, real-time revocation, and audit logs.
How fast can we revoke access?
Revocation is immediate and propagated across all integrated resources in sub-second latency. When a sponsor withdraws a mandate or an employee changes roles, active tokens and session authorizations are instantly terminated with zero grace period.
How long are audit logs retained?
Retention schedules are configurable according to your sector's regulatory mandates (e.g., 7 years for SOX/financial records, 6 years for HIPAA). Audit records are stored in immutable WORM-compliant storage with verifiable cryptographic signatures.
Who is accountable if something goes wrong?
Every regulated action provides an unbroken chain of accountability linking the acting principal, the authorizing sponsor, the governing policy version, and the timestamped cryptographically signed mandate. Regulators can audit the exact decision context.
What protocols does Zoiko iD support?
Zoiko iD supports modern identity standards including OIDC, OAuth 2.0, SAML 2.0, SCIM, SPIFFE/SPIRE for workload identities, as well as native REST APIs, webhooks, and SDKs for Python, Node, Go, and Java.
Ready to
implement compliance-
ready identity?Ready to implement compliance-ready
identity?
Let's discuss your regulatory requirements, architecture, and implementation timeline. We'll help you build identity, authority, and evidence infrastructure that your auditors will trust.