Identity & Access
Your identity provider,
your rules, enforced everywhere.
Quadrazene does not ask you to move your users. It signs them in through the directory you already run, turns directory groups into roles, gives machines identities of their own, and decides on every request whose credentials the data behind it should see.
Sign-in and provisioning
Six ways in, one permission model.
Every route ends in the same place: a user with role bindings, checked on every request.
Map LDAP distinguished names, OIDC claims, RADIUS Filter-Id groups or SCIM-synced groups to roles, at tenant scope or narrowed to a Refinery.
Roles, groups and policy
Least privilege that people can actually administer.
System and custom roles
Capability patterns bound to a user, a group or a service principal, at tenant scope or narrowed to a Refinery or a single resource.
Access policies
Reusable, named permission bundles you attach to any role, so a control is defined once and reused.
Groups
RBAC groups with their own role bindings. Queues, sharing and dashboards all reuse the same group mechanism.
Attribute-based conditions
add-onWith Advanced RBAC, decisions can depend on attributes of the caller and the resource, not only on role membership.
Access reviews
add-onA periodic queue of bindings to approve, revoke or rescope before they expire.
Dedicated AI capability
Invoking the Reactor and AI inference has its own capability, so a role can read data without being able to spend on models.
Non-human identities
Machines get identities, not shared passwords.
Service principals
M2M callers and background jobs are RBAC identities bound to roles like any user, so their access is reviewable.
Scoped API keys
Bearer keys for external callers, granted per key and per resource. There is no default access to inherit.
Quadrazene as an IdP
Issue OIDC tokens to downstream systems, with a managed signing key, a JWKS endpoint, a discovery URL and rotation.
SCIM in
Users and groups are provisioned and deprovisioned from your directory, with no one keying accounts by hand.
Hardened RADIUS
Access requests carry a Message-Authenticator, so servers enforcing current RADIUS hardening do not silently drop them.
Delegated tokens
add-onWith Advanced RBAC, a caller can be handed a narrower, delegated token instead of its own full credentials.
System access
Whose credentials does the query run under?
Choose per System. It is the difference between 'the app can read everything' and 'the user can read what the user may read'.
Shared
One governed service credential for the System.
Per-user
Each person's own credential, held in their vault.
Entra OBO
On-behalf-of token exchange, so the source sees the user.
STS
Short-lived cloud credentials minted per request.
DB impersonation
The query runs as the user inside the database.
QZ as IdP
Quadrazene issues the token the downstream system trusts.
Plug in your directory.
Tell us where your users live and we'll map the groups to roles before the first sign-in.