Access Control
Witboost provides comprehensive, enterprise-grade access control that integrates with your existing identity infrastructure.
Identity Provider Integration
Witboost delegates authentication to the customer's own identity provider using OAuth2 / OpenID Connect (OIDC). Supported providers include:
- Microsoft Entra ID (Azure AD)
- Okta
- Any OIDC-compliant provider
The customer retains full control over:
- User provisioning and deprovisioning
- Multi-factor authentication (MFA) policies
- Session duration and idle timeout
- Password policies and complexity requirements
- Access revocation
Important
Agile Lab does not operate or have access to the identity provider. The IdP is the customer's own system and is not a sub-processor.
Role-Based Access Control (RBAC)
Witboost implements fine-grained RBAC with the following hierarchy:
| Role Level | Description |
|---|---|
| Administrator | Full platform administration, policy management, and template management |
| Read Only | Read-only access to catalog and platform information |
| Data Product Owner | Manages data products, their components, and related ownership responsibilities |
| Data Product Developer | Creates and maintains data products and their components |
| Governance | Reviews and manages governance policies and validation activities |
| Data Product Data Access Manager | Manages access requests and grants for data product output ports |
These are the default roles provided out of the box. Customers can define any number of custom roles, each with its own set of permissions and scoped to specific levels of the organisational hierarchy:
- Domain — restrict a role to one or more business domains
- System — scope permissions to individual products or applications
- Landscape — apply roles across an entire deployment landscape
- Environment — differentiate permissions between development, staging, and production environments
This means organisations can model role structures that mirror their governance policies exactly, without being constrained by a fixed set of profiles.
Key RBAC Features
- Least-privilege principle — Users receive only the minimum permissions necessary for their role
- Flexible assignment — Roles can be assigned to groups from the identity provider or to individual users, at the customer's discretion
- Granular visibility — Different catalog areas can be restricted to specific roles or groups
- No shared accounts — All actions are attributable to individual, authenticated users
Access Request Workflow
Access to products follows a governed workflow:
- Consumer requests access through the Marketplace UI
- Product Owner reviews the request with full context (requester identity, purpose, scope)
- Approval or rejection is recorded with an audit trail
- Access is provisioned automatically upon approval via the appropriate Tech Adapter
- Access can be revoked at any time by the Product Owner
Multi-Step Approval Workflows
Witboost supports configurable approval workflows for sensitive operations:
- Access requests can be routed through multiple approval steps, involving different stakeholders at each stage
- Approval chains are fully customisable — organisations can define who needs to approve, in what order, and under which conditions
- Every step is recorded with approver identity, decision, and timestamp, providing a complete audit trail
Privileged Access Management
- Role-based administrative access — Administrative permissions are assigned through configured RBAC roles and the customer's IdP
- Session controls — Inactive sessions are automatically terminated after a configurable timeout
- Audit trail — Privileged actions are logged according to the configured audit and logging setup
- SIEM integration — Access logs can be collected and forwarded by the customer's Kubernetes and logging infrastructure for centralised monitoring
Access Logging
All access events are recorded:
| Event Type | Details Logged |
|---|---|
| Authentication | User login/logout, authentication method, source IP |
| Authorization | Resource accessed, permission evaluated, result (allow/deny) |
| Data Access | Which metadata was accessed, by whom, when |
| Administrative | Configuration changes, role assignments, policy modifications |
| Deployment | Who deployed what, approval chain, timestamp |