Sign in through your identity provider. Approve with a passkey. Every permission is denied unless granted.
OpenID Connect at the gateway. Entra ID in production today. The gateway reads the provider's discovery document, so another OpenID Connect provider is configuration. The engine holds no passwords.
Server-side sessions held in Redis. The API trusts the gateway, never the browser. A system action presents a signed service token, never a bare header.
Every command, query and endpoint has a permission entry, granted per role per tenant. A missing entry is a build failure, not a hole.
The operations you choose need a second person. Whoever initiated or contributed to a change can never approve it. Segregation of duties is a register row, not a policy document.
An approver enrols a phone passkey and signs each decision with it. The signature is stored on the approval event and can be verified again, months later, without the engine's help. WebAuthn Level 2.
Who, when and on whose authority sit on every event. The audit trail is not a log beside the system. It is the system.
A CycloneDX SBOM of the built solution is generated every week and kept as a build artefact. Available to a customer on request.
The SBOM is scanned with Grype and the package graph checked for known-vulnerable dependencies, transitive ones included. A weekly report, reviewed by a person.
Dependabot raises updates for .NET packages, the interface's npm packages and the build actions themselves, between the weekly scans.
Gateway, API, worker and migrations are built from one file and pushed to a registry per release, so what runs is what was scanned.
What this means for you: your security team gets a standard identity integration, a maker-checker model that satisfies segregation of duties, and a bill of materials with the release.