Identity and Access Control
One identity and access layer for people and AI agents
Mantle is the identity, access and organization layer every other product builds on. Organizations nest into a tree, permissions cascade down it, and each root organization is a hard data-isolation boundary. One permission model decides what every person and AI agent can reach, with single sign-on, directory provisioning that holds risky changes for approval, access reviews and delegated administration built in, so you never rebuild identity for each product.
When each product carries its own permission model, access drifts between them. Mantle is the one identity, access, and organization layer every Neuraforge product resolves against: nested organizations with hard data boundaries, single sign-on and directory sync per organization, and one permission engine for people and AI agents alike.
- Nested organizations with isolated data boundaries and full inheritance
- Relationship-based access — ownership, roles, teams, and direct grants — plus attribute policies for time, IP, location, and device
- Per-organization single sign-on (OIDC and SAML) with group mapping, SCIM provisioning, and directory sync that holds mass removals
- Time-scoped access requests and reviews, service principals, and a list of shared things whose owner left
- Full activity log and audit trail for every permission change and access event
What you get
What Mantle gives your team.
Nested organizations
Members, teams and branding at any depth, with each root organization forming an isolated data boundary and settings inherited down the tree.
Relationship-based access
Ownership, roles, team membership and direct grants combine into one effective permission per request, inherited down the organization tree.
Conditional policies
Layer time, network, location and device rules over any grant, enforcing or report-only, and restrict sign-in by network, access window or device.
Single sign-on and provisioning
Per-organization OIDC and SAML 2.0 sign-in with a creation mode, profile refresh and group-to-role mapping, plus SCIM 2.0 and Entra or Active Directory sync.
Reviews and requests
Time-scoped access reviews disable or revoke on lapse, access requests flow to approvers, and one decision inbox shows every pending approval.
Held changes and safe departures
Directory, SCIM and sign-in changes that look risky wait for a person on a Held changes page, with a people-counted brake. A ban stops the person without breaking shared automations.
How it works
- 1
Model your organizations
Create a tree of organizations with members, teams and branding. Each root organization is a hard data-isolation boundary, and permissions cascade down the tree.
- 2
Assign roles and access rules
Grant system or custom roles and team permissions, then layer organization policies by time, network, location or device. Tighten sign-in by network, window, device or browser, with report-only testing.
- 3
Connect your identity provider
Add per-organization OIDC or SAML single sign-on, SCIM 2.0 provisioning or Microsoft Entra directory sync. Active Directory is read at the edge by an agent on your own network.
- 4
Review, approve and audit
Run time-scoped access reviews, decide pending items in the decision inbox, and use the effective-access report to see who holds what and by which path, backed by a tamper-evident audit trail.
Ask AI about Mantle
Every Mantle page has an Ask AI button. It opens a chat that already has the page, its rows, and your selection. Try asking:
- Show me the organizations in the region the map is currently displaying.
- Which held identity changes on this page came from a directory, and what do they request?
- Which people shown here are banned?
How teams use it
- Delegate administration to a subsidiary without letting it see other organizations' data.
- Sync your directory and remove leavers' access automatically with a safety brake on mass removals.
- Answer an auditor's question of who holds what access, and by which path.
Frequently asked questions
See Mantle in action
Join the early-access list, or talk to our team about your environment.
Talk to us