Identity, authority, and
bounded access for your
workforce.
Connect your enterprise identity infrastructure with verifiable organization context, role-
based authority, and continuous trust evaluation.
Explore Integration
Talk to expertWorkforce lifecycle & trust model
1. Onboard
Employee hired.
Provisioned in IdP
and HRIS. Awaiting
role assignment.
2. Assign Role
Manager assigns
role. Access policies
activated. Context
established.
3. Active Access
Employee performs
authorized actions.
Decisions audited.
Continuous monitoring.
4. Role Change
Promotion or
transfer. New role
activated. Old access
revoked immediately.
5. Leave /
Suspend
Planned time off or
leave. Access paused. Automatically
resumed or revoked.
Choose your workforce access challenge
Enterprise Federation
Connect customer Okta,
Azure AD, or Ping
instances. Authenticate
via their IdP while adding
organization context
and authority evaluation.
Role & Policy Based
Define and enforce
role-based access
within organizations.
Map HRIS, directory, or
custom role hierarchies
to resource permissions.
Delegation & Escalation
Managers delegate
task approval or
temporary access to
team members. Bounded,
auditable, revocable at
any time.
Continuous Trust
Monitor role changes,
terminations, and risk
signals. Re-evaluate
and revoke access
immediately when
conditions change.
Actor, affiliation & authority model
Employee
Authenticated user with assigned role.
Authority limited to defined scope and
policy.
Manager
Can delegate tasks, approve access
requests, manage team members.
Auditable authority.
Organization
Customer entity that owns employees,
roles, policies, and can revoke access
instantly.
Policy Engine
Evaluates access requests. Applies role,
time, location, risk signals. Makes
allow/deny decisions.
Audit & Compliance
Reviews decision logs, access changes,
role hierarchy. Searches for compliance
evidence.
Workflow / Bot
Automated process acting on behalf of
org. Requires explicit grant and monitoring.
Enterprise federation & overlay
Your IdP remains the source of truth
No user migration. No credential replacement. Employees
authenticate via Okta, Azure AD, Ping, or your own IdP. Zoiko iD
receives authenticated identity and organization context, adds
authority evaluation and audit evidence.
Continuous trust & revocation
Role Changed
Promotion or transfer
detected. New role applied.
Old permissions revoked
immediately.
Leave Scheduled
Vacation or leave detected
in HRIS. Access paused on
start date. Resumed or
revoked on end date.
Offboarding
Termination detected. All
access revoked instantly.
Sessions terminated.
Logged completely.
Risk Signal
Suspicious activity
detected. Elevated auth
required or access
restricted until review.
Delegation & least privilege
Bounded Delegation
A manager can delegate approval authority, access requests, or
time-limited permissions to a team member. Every delegation
includes:
Enterprise security, privacy & assurance
Data Isolation
Per-tenant isolation. No
cross-org data leakage.
Access controls enforced
at database level.
Privacy First
Minimal PII collection.
Credentials never logged.
Data subject rights
supported.
Least Privilege
Every access grant explicit
and scoped. No implicit
permissions. Time-limited
by default.
Verified Claims
Security, compliance,
certifications backed by
evidence and attestation.
Integration evaluation path
REST API
Query org context, evaluate access,
fetch evidence. Request status:
SCIM Provisioning
Sync users, groups, roles from IdP. Real-
time updates. Status:
Webhooks
Real-time notifications on role changes,
offboarding, access decisions. Status:
Per-action
authorization
Who is requesting?
Authenticated employee identity confirmed. Organization
membership verified.
What is their role?
Current role and associated permissions looked up. Manager,
director, engineer, auditor?
What are they accessing?
Resource, action, and scope identified. Protected data,
admin panel, customer records?
What does policy say?
Organization policy applied. Time-of-day, IP location, risk
score, MFA status considered.
Allow or deny?
Decision made in milliseconds. Reason logged. Evidence
recorded for audit.
Evidence, provenance
& review
Who Acted
Employee identity, organization, and timestamp of
decision or access attempt.
What Role
Role at time of action. Role history and delegations linked
in evidence.
Immutable Audit Log
Evidence retained per policy. Searchable, indexed, and
compliance-ready.
What Resource
Resource ID, action, and scope requested. Access path
traced.
Policy Applied
Policy version, time, location, MFA status, risk signals all
logged.
Decision
Allow or deny. Reason category. If denied, guidance
provided.
Capability & boundary matrix
| Capability | Status | Notes |
|---|---|---|
| SAML / OIDC Federation | Available | Connect to customer IdP. Authenticate via their provider. |
| OAuth 2.0 Support | Available | Third-party app integration. Token-based authorization. |
| SCIM 2.0 Provisioning | Available | Auto-sync users, groups, roles from customer IdP. |
| Policy-Based Access | Available | Define and enforce rules per role, org, time, location. |
| Audit & Evidence Logging | Available | Immutable logs of all access decisions and policy changes. |
| Delegation & Escalation | Available | Bounded, time-limited delegation with full audit trail. |
| Continuous Re-evaluation | Available | Monitor role changes, offboarding, and policy updates. |
| Device Posture Checks | Planned | Validate device compliance before granting access. Q2 2027. |
| Real-Time Risk Scoring | Planned | ML-based anomaly detection. Requires partner integration. Status TBD. |
Frequently asked questions
Do you replace our IdP?+
No. Zoiko iD does not replace your customer's identity provider. Existing enterprise IdPs (such as Okta, Azure AD, or Ping) remain the authoritative source for authentication, while Zoiko iD adds organization context, membership lifecycle management, and policy-driven authority.
Can you sync roles from our HRIS?+
Yes. Zoiko iD supports direct SCIM synchronization and API-based ingestion from major HRIS and directory platforms, automatically translating organizational roles and departments into bounded permissions.
How does delegation work?+
Managers can delegate task approval authority, access requests, or time-limited permissions to team members. Every delegation is bounded by specific scope, time limit, and mandate reference in the immutable audit trail.
What happens when someone is terminated?+
When termination is detected in the IdP or HRIS, Zoiko iD triggers instant access revocation across all connected systems, terminates active sessions immediately, and logs the complete audit event.
How long is access history retained?+
Access decision logs and audit evidence are retained per your enterprise retention policy in tamper-evident, compliance-ready storage that is fully searchable and indexable for regulatory review.
What if your service is unavailable?+
Zoiko iD is engineered for continuous high availability with globally distributed edge points, redundant policy decision caches, and offline fallback fail-safe mechanisms ensuring workforce continuity.
Connect identity, authority, and audit
in one platform.
Discuss your workforce and enterprise access challenges with our identity architects.
We will understand your infrastructure and recommend an integration path.
Talk to an expert
View technical specs