Identity, Access &
Organization Control
The foundation of every AI action. Lomarix Identity establishes who can act — providing enterprise-grade authentication, multi-tenant isolation, role-based access, licensing, and cost attribution.
Four Problems Every Enterprise Must Solve Before Writing a Single AI Agent
Who Is This?
Authentication that cannot be forged or replayed — and works for both humans (browsers) and machines (background workers).
What May They Do?
Role-based access control with a real hierarchy, not a boolean is_admin. Granular permissions down to individual project access.
Whose Data Is This?
Strict tenant isolation so that Acme Corp can never see Globex Corp's documents, leads, or incidents — even accidentally, even in a background job.
Who Pays for This?
Cost attribution down to the individual user and project — because enterprise CFOs will not approve AI spend they cannot decompose.
Everything You Need to Govern Enterprise AI Access
Enterprise Authentication
Email/password with bcrypt, 60-minute access tokens, 7-day refresh rotation, silent refresh, forced password change for invited users, and HttpOnly cookies immune to XSS.
Role-Based Access Control
Six seeded system roles with custom per-org roles, numeric hierarchy preventing privilege escalation, permission-based route guards, and per-project access grants.
Multi-Tenant Organizations
Organization CRUD with plan tiers (starter/professional/enterprise), shared or dedicated deployment modes, and nested project management under each org.
App Registry & Licensing
Global app catalogue with org-level and project-level licences, seat caps, expiry dates. HR gets Cortex, Finance gets PFA — controlled by a row change, not a deployment.
API Key Management
Create, list, and revoke keys per org. SHA-256 hashed at rest, prefix stored for display, system keys enable the Assume-Role pattern for service-to-service auth.
Billing & Observability
Cost breakdowns by model, project, user, and time period. Token usage tracking, trace/span drill-down, and evaluation trends — all from a single pane of glass.
Why Identity Is the Foundation
Zero Shared Secrets
RS256 asymmetric signing means Identity holds the private key. Every other service verifies with the public key. A compromised downstream service cannot mint tokens.
SSO for Free
HttpOnly cookies on the .lomarix.com domain grant access to every sub-app. One login, every product — no OAuth dance between internal apps.
Offline Authorization
JWT claims carry org_id and project_ids. Downstream services validate scope without calling Identity — stateless, fast, resilient.
Product Enablement as Data
Adding or revoking a product for a tenant is a row change, not a deployment. Scale from 1 to 10,000 tenants without touching infrastructure.
How Enterprises Use Identity
Multi-Tenant AI SaaS
Run hundreds of enterprise clients on a shared platform with strict data isolation. Each org gets its own projects, users, roles, and licensed apps — completely separated.
Departmental AI Rollout
Give HR access to Cortex, Finance to PFA, and IT to Sentinel — all through project-level licensing. No over-provisioning, no accidental access.
AI Cost Governance
CFOs get per-user, per-project, per-model cost breakdowns. Budget holders see exactly where AI spend goes — no more opaque "AI infrastructure" line items.
Without Identity, You Don't Have a Platform
Identity is on the critical path for every interaction. Every login, every API call, every token refresh flows through this layer. Without it, every product reimplements auth badly and inconsistently, and multi-tenancy bugs become a matter of when, not if.
Lomarix Identity ensures that every AI action across Gateway, Cortex, Droidons, and every future product is authorized, attributed, and auditable — from a single, secure, independent microservice.
Built on This Foundation
Ready to Build on a Solid Foundation?
Identity is included with every Lomarix deployment. Talk to us about how the platform can transform your enterprise AI operations.
Schedule a Demo