> For the complete documentation index, see [llms.txt](https://handbook.harmonic.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://handbook.harmonic.security/handbook/1.-identity-and-access.md).

# 1. Identity & Access

How to manage human and non-human identity across AI platforms, including SSO, SCIM, RBAC, tenant restrictions, domain claiming, and agent service accounts.

*Last reviewed: August 18, 2026*

{% hint style="info" %}
Identity is the first control. If you cannot enforce managed login and govern who has access to which AI platforms, every other control is built on sand.
{% endhint %}

## Articles in this section

1. [1.1 SSO & SCIM for AI platforms](/handbook/1.-identity-and-access/1.1-sso-and-scim-for-ai-platforms.md)
2. [1.2 RBAC across AI platforms](/handbook/1.-identity-and-access/1.2-rbac-across-ai-platforms.md)
3. [1.3 Tenant restrictions: blocking personal accounts](/handbook/1.-identity-and-access/1.3-tenant-restrictions-blocking-personal-accounts.md)
4. [1.4 Domain claiming: bringing shadow accounts into enterprise](/handbook/1.-identity-and-access/1.4-domain-claiming-bringing-shadow-accounts-into-enterprise.md)
5. [1.5 Agent and non-human identity](/handbook/1.-identity-and-access/1.5-agent-and-non-human-identity.md)
6. [1.6 API keys and service accounts governance](/handbook/1.-identity-and-access/1.6-api-keys-and-service-accounts-governance.md)
7. [1.7 Human-in-the-loop and approval policies](/handbook/1.-identity-and-access/1.7-human-in-the-loop-and-approval-policies.md)

## Frequently asked questions

**Is SSO enough to secure an AI platform?**\
No. SSO controls the managed sign-in path. It does not automatically govern personal accounts, API keys, local credentials, workload identities, connector grants, or every hosted execution path. Pair SSO with lifecycle provisioning, tenant restrictions, capability-based roles, credential governance, and tested revocation.

**How should agent identity differ from user identity?**\
Use a dedicated, attributable workload identity for unattended or shared work. Give it narrow scopes, short-lived credentials where possible, a named owner, and a separate revocation path. Preserve the initiating user when a person launches the task.

## Related handbook guidance

* [AI Security Handbook](/ai-security-handbook.md)
* [7.4 The vendor-neutral control matrix](/handbook/7.-rollout-and-operations/7.4-the-vendor-neutral-control-matrix.md)
* [Security Team Checklist](/start-here/security-team-checklist.md)
* [Glossary](/start-here/glossary.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://handbook.harmonic.security/handbook/1.-identity-and-access.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.