# Customer access

URL: /systems/customer-access · Id: `system:customer-access`

> Customer access governs who acts in each Customer’s Tenant: members, invitations, Roles, Permissions, sign-in connections, directory sync and keys.

Customer access decides who acts inside each [Customer](/business/nouns/customer)’s [Tenant](/business/nouns/tenant): members, invitations, [Roles](/business/nouns/role), [Permissions](/business/nouns/permission), single sign-on, directory sync and API keys. A buyer’s [Agent](/business/nouns/agent) provisions a Tenant itself, and a [Human](/business/nouns/human) admin claims it later.

## Summary
| Part | This System |
| --- | --- |
| Group | Customers and identity |
| Status | Live |
| Shelf | Front: offered from a Startup’s first days |

You can ask:

- “Let a customer invite their team”
- “Turn on SSO for this customer”
- “Give their IT admin a setup link”
- “Remove this person’s access”

## What you get
| Part | This System |
| --- | --- |
| Starts | On for every Startup at creation, with nothing to install. |
| Built from | [Identity](/code/platform/identity), [Permissions](/code/platform/permissions), [Tenancy](/code/platform/tenancy), [Audit log](/systems/trust-and-governance/audit-log) |

## Nouns it owns
| Noun | Definition |
| --- | --- |
| [Tenant](/business/nouns/tenant) | A Tenant is the partition of a Startup’s data that belongs to one Customer. |
| [Permission](/business/nouns/permission) | A Permission is what a Role may do: a Verb on a Noun within a scope, optionally bounded by a Limit. |
| [SSO Connection](/business/nouns/sso-connection) | An SSO Connection links a Customer’s own identity system to its Tenant, so the Customer’s people sign in through it. |
| [Member Directory](/business/nouns/member-directory) | A Member Directory is a Customer’s own list of people and groups, pushed into its Tenant so access follows employment. |

## Verbs
| Verb | Object | Approval | Event |
| --- | --- | --- | --- |
| [Tenant.provision](/business/nouns/tenant/provision) | [Tenant](/business/nouns/tenant) | None | [`Tenant.provisioned`](/business/events/Tenant.provisioned) |
| [Human.invite](/business/nouns/human/invite) | [Human](/business/nouns/human) | None | [`Human.invited`](/business/events/Human.invited) |
| [Permission.create](/business/nouns/permission/create) | [Permission](/business/nouns/permission) | None | `Permission.created` |
| [Permission.update](/business/nouns/permission/update) | [Permission](/business/nouns/permission) | None | `Permission.updated` |
| [Tenant.invite](/business/nouns/tenant/invite) | [Tenant](/business/nouns/tenant) | None | [`Tenant.invited`](/business/events/Tenant.invited) |
| [Tenant.requestSetup](/business/nouns/tenant/request-setup) | [Tenant](/business/nouns/tenant) | None | [`Tenant.setupRequested`](/business/events/Tenant.setupRequested) |
| [SSOConnection.activate](/business/nouns/sso-connection/activate) | [SSO Connection](/business/nouns/sso-connection) | None | [`SSOConnection.activated`](/business/events/SSOConnection.activated) |
| [MemberDirectory.provision](/business/nouns/member-directory/provision) | [Member Directory](/business/nouns/member-directory) | None | [`MemberDirectory.provisioned`](/business/events/MemberDirectory.provisioned) |
| [MemberDirectory.deprovision](/business/nouns/member-directory/deprovision) | [Member Directory](/business/nouns/member-directory) | None | [`MemberDirectory.deprovisioned`](/business/events/MemberDirectory.deprovisioned) |
| [SSOConnection.deactivate](/business/nouns/sso-connection/deactivate) | [SSO Connection](/business/nouns/sso-connection) | None | [`SSOConnection.deactivated`](/business/events/SSOConnection.deactivated) |
| [MemberDirectory.deactivate](/business/nouns/member-directory/deactivate) | [Member Directory](/business/nouns/member-directory) | None | [`MemberDirectory.deactivated`](/business/events/MemberDirectory.deactivated) |

## Events
| Direction | Event | How |
| --- | --- | --- |
| Emits | [`Tenant.provisioned`](/business/events/Tenant.provisioned) | By [Tenant.provision](/business/nouns/tenant/provision) |
| Emits | [`Human.invited`](/business/events/Human.invited) | By [Human.invite](/business/nouns/human/invite) |
| Emits | `Permission.created` | By [Permission.create](/business/nouns/permission/create) |
| Emits | `Permission.updated` | By [Permission.update](/business/nouns/permission/update) |
| Emits | [`Tenant.invited`](/business/events/Tenant.invited) | By [Tenant.invite](/business/nouns/tenant/invite) |
| Emits | [`Tenant.setupRequested`](/business/events/Tenant.setupRequested) | By [Tenant.requestSetup](/business/nouns/tenant/request-setup) |
| Emits | [`SSOConnection.activated`](/business/events/SSOConnection.activated) | By [SSOConnection.activate](/business/nouns/sso-connection/activate) |
| Emits | [`MemberDirectory.provisioned`](/business/events/MemberDirectory.provisioned) | By [MemberDirectory.provision](/business/nouns/member-directory/provision) |
| Emits | [`MemberDirectory.deprovisioned`](/business/events/MemberDirectory.deprovisioned) | By [MemberDirectory.deprovision](/business/nouns/member-directory/deprovision) |
| Emits | [`SSOConnection.deactivated`](/business/events/SSOConnection.deactivated) | By [SSOConnection.deactivate](/business/nouns/sso-connection/deactivate) |
| Emits | [`MemberDirectory.deactivated`](/business/events/MemberDirectory.deactivated) | By [MemberDirectory.deactivate](/business/nouns/member-directory/deactivate) |
| Emits | [`SSOConnection.failed`](/business/nouns/sso-connection#ssoconnectionfailed) | Raised by the rail |
| Emits | [`MemberDirectory.failed`](/business/nouns/member-directory#memberdirectoryfailed) | Raised by the rail |

## States
The lifecycle of a [SSO Connection](/business/nouns/sso-connection):

| State | Meaning | Moves to |
| --- | --- | --- |
| `draft` (first) | Its configuration is entered, and no test sign-in has passed. | `active` by [SSOConnection.activate](/business/nouns/sso-connection/activate) |
| `active` | Everyone in the Tenant signs in through it. | `failing` on [`SSOConnection.failed`](/business/nouns/sso-connection#ssoconnectionfailed); `inactive` by [SSOConnection.deactivate](/business/nouns/sso-connection/deactivate) |
| `failing` | Sign-ins through it fail, and the Customer’s admin has been told why. | `active` by [SSOConnection.activate](/business/nouns/sso-connection/activate); `inactive` by [SSOConnection.deactivate](/business/nouns/sso-connection/deactivate) |
| `inactive` | Turned off: nobody signs in through it, and its configuration is kept. | `active` by [SSOConnection.activate](/business/nouns/sso-connection/activate) |

Its other Nouns with a lifecycle: [Member Directory](/business/nouns/member-directory).

## Who operates it
| Part | This System |
| --- | --- |
| Accountable | [Security Engineer](/agents/engineering/security-engineer) |
| Team | [Engineering Team](/agents/engineering) |
| Seat | A role agent holds it until a Human is seated. |
| Autonomy | `supervised` |
| Also calls its Verbs | [Integration Engineer](/agents/engineering/integration-engineer), [Onboarding Specialist](/agents/customer/onboarding-specialist), [People Lead](/agents/people/people-lead), [Recruiter](/agents/people/recruiter) |

## Approvals and limits
| Verb | Rule | Detail |
| --- | --- | --- |
| [Human.invite](/business/nouns/human/invite) | Mandate `trial` for the [Recruiter](/agents/people/recruiter) | Invites candidates to paid work trials and verifies their Credentials. |

## Processes that use it
| Process | How it uses it |
| --- | --- |
| [Security](/workflows/processes/security) | A Workflow writes [Permission](/business/nouns/permission) |
| [Onboarding](/workflows/processes/onboarding) | A step calls [Tenant.provision](/business/nouns/tenant/provision) |
| [Staffing](/workflows/processes/staffing) | A step calls [Permission.create](/business/nouns/permission/create) |

## Rail underneath
None.

## Views and dashboards
| View | Shows | Metrics |
| --- | --- | --- |
| The [Security Engineer](/agents/engineering/security-engineer)’s view | The Metrics its accountable Role answers for. | [Unused Permissions](/agents/engineering#unused-permissions) |

## Access
What each Access level may call here.

| Access level | May call |
| --- | --- |
| `owner` | Every Verb (27) |
| `admin` | Every Verb (27) |
| `member` | All but 12 of 27: `MemberDirectory.create`, `MemberDirectory.update`, `MemberDirectory.deactivate`, `MemberDirectory.deprovision`, `MemberDirectory.provision`, `Permission.create`, … |
| `viewer` | Read only (8 of 27) |

## Import and export
None.

## Fees and pricing
None.

## Availability and limits
| Part | This System |
| --- | --- |
| Status | Live |

## Compliance notes
Every sign-in and Permission change lands in the audit log; who a Customer admits stays theirs.

Controls it carries:

- [Action accountability](/systems/trust-and-governance/controls/action-accountability)
- [Log completeness](/systems/trust-and-governance/controls/log-completeness)
- [Authenticated Actions](/systems/trust-and-governance/controls/authenticated-actions)
- [Task-bound access](/systems/trust-and-governance/controls/task-bound-access)
- [Permission decay](/systems/trust-and-governance/controls/permission-decay)
- [Permission widening](/systems/trust-and-governance/controls/permission-widening)
- [Namespace isolation](/systems/trust-and-governance/controls/namespace-isolation)
- [Append-only records](/systems/trust-and-governance/controls/append-only-records)
- [Revert by query](/systems/trust-and-governance/controls/revert-by-query)
- [Input validation](/systems/trust-and-governance/controls/input-validation)
- [Purpose limitation](/systems/trust-and-governance/controls/purpose-limitation)
- [Disclosure record](/systems/trust-and-governance/controls/disclosure-record)

## Related Systems
- [Privacy](/systems/privacy)
- [Billing](/systems/billing)

## Example
A [Headless SaaS](/products/templates/headless-saas) for invoice parsing sells [b2a2b](/business/motions/b2a2b): a finance team’s Agent signs up, provisions a Tenant and starts calling the API. When the controller arrives, one link makes her the Tenant admin, and her company’s single sign-on takes over every seat.