Enterprise identities
Register governed integrations
Create organization-owned confidential applications with explicit scopes, team workspace grants, service credentials, webhooks, usage controls, and audit history.
Ownership model
Organization, application, workspace
Create an application
Configure least privilege first
Select the owning organizationUse a descriptive application nameSelect only required scopesGrant explicit team workspacesStore the one-time secret in a secret managerTest identity and workspace isolation
Personal workspaces are user contexts
Organization service applications use explicitly granted team workspaces. A workspace identifier narrows access but never grants it by itself.
Common service scopes
Build access incrementally
| Capability | Typical scopes |
|---|---|
| Discovery | workspaces:read documents:read |
| Knowledge | knowledge:query knowledge:generate sessions:write |
| Ingestion | documents:write |
| Batch operations | batches:read batches:write |
| Vertical workflows | workflows:read workflows:write |
| Knowledge Academy | learning:read learning:participate learning:manage |
| Events | events:write |
A scope allows a capability. Organization status, application status, workspace grant, membership, role, course persona, and resource ownership are enforced separately.
Lifecycle
Operate without sharing permanent credentials
Add or remove approved scopes and workspaces. New access requires a newly issued token.
Request an unassigned scope with a business reason and route it to DocIntel administration for approval.
Create a new one-time secret while older active secrets remain valid for a bounded overlap.
Optionally permit Client Credentials token requests only from configured IPv4 or IPv6 CIDRs.
Review application creation, access updates, scope decisions, rotations, revocations, and suspension events.
Block service access without deleting organization configuration or historical evidence.