Identity OS OS

Operator surface for the identity os workforce. Run, inspect, and approve every agent action.

Admin surface: /admin/identity-osStatus: PARTIALPriority: P0

Panels

AI systems

  • · radar anomaly scorer (shipped — 10 signal kinds incl. AGENT_RUNAWAY/AGENT_COST_SPIKE/AGENT_DESTRUCTIVE_CALL)
  • · MFA risk-classifier hook (shipped — DESTRUCTIVE skill ⇒ WebAuthn step-up)
  • · RBAC skill-scope PDP (shipped — roles authorize skill IDs, not just routes)

Backend services

  • · identity-provider-store
  • · audit-log-store
  • · magic-auth-store
  • · vault-store
  • · radar-signal-store

Known gaps in this domain (registry-disclosed)

  • · BoxyHQ SAML Jackson HTTP wiring (cycle 80)
  • · libsodium + KMS envelope encryption in vault-secret-store (cycle 80)
  • · Prisma promotion of magic-auth + radar in-process stores (cycle 81)
  • · Hosted Admin Portal CNAME provisioning via Cloud DNS API (cycle 82)
  • · HRIS Rippling / Workday SCIM bridge (cycle 83)

Next action: Cycle 80 — wire BoxyHQ SAML Jackson behind connection-state-machine.ts; flips PARTIAL rows to FULL → net advantage moves from -8 to ~+18.