Enterprise user management

Manage sign-in and product access separately. When organization sign-in is enabled, a person needs identity-provider access and VeriProof membership.

Add a person

1. Assign the person to the approved identity-provider application.
2. Add the person in Settings → Team → Members.
3. Choose the VeriProof role needed for their work.
4. Add application or audit scope where required.
5. Verify permitted access using that person’s account. In an authorized access test, confirm that an out-of-scope request is denied.

Provider groups do not create VeriProof members or assign VeriProof roles.

Change access

When responsibilities change, review access in both systems. Check application assignments, custom-role capabilities, audit engagements, and group-derived scope as well as the main role.

When a person leaves, remove access from both systems. Confirm that the account can no longer perform protected actions; a changed member list is not enough.

Automation

Do not create a human account for an autonomous workload.

• Use an application SDK key for application runtime calls supported by that key.
• Use the registered MCP workload or connector flow for supported autonomous agent operations.
• Use delegated user sign-in when the action requires a person’s role or approval authority.

An application SDK key does not grant portal or MCP user permissions.

Recovery access

Maintain the administrator recovery path supported by your release and operating model. Protect its credentials and test it under controlled conditions. Review every use.