One Access Model. Every Endpoint.
One auth layer across every endpoint. JWT-based identity, org-scoped multi-tenancy, and hierarchical RBAC.
Authentication Flows
Two authentication paths, one token format. Users and robots both receive JWTs scoped to an organization.
User Login
Robot Login
Two Identity Types
Human users and machine accounts. Different credentials, same RBAC model.
Users
Human operators with username/password credentials. Full access level range from SuperAdmin to Read.
- SHA-256 hashed passwords with per-user salt
- All five access levels (SuperAdmin → Read)
- Self-service password updates
- Admin-managed lifecycle (create, update, delete)
- Only SuperAdmin can create other admins
Robots (Service Accounts)
Machine identities for agent systems, CI/CD pipelines, and inter-service communication.
- API key format: eden_<64-hex-chars>
- SHA-256(salt || key) — plaintext never stored
- Limited to Read or Write access only
- Key rotation via dedicated endpoint
- Admin+ required to create and manage
Access Level Hierarchy
Five hierarchical levels. Each level inherits all permissions of the levels below it. Permission check: current_level <= required_level.
Full control — delete resources, manage all permissions, create admins
Manage permissions, grant/revoke access, add/remove writers and readers
Modify resource settings and data, execute write operations
View resources, execute read operations, connect to endpoints
No access — default for all subjects until explicitly granted
RBAC Model
Every permission is a triple: Subject has AccessLevel to Entity. Two-tier verification with organization-level and resource-level checks.
Two-Tier Permission Verification
Entity Types
Top-level tenant boundary. Controls who can access the org and its resources.
Individual database, LLM, or API connections. Fine-grained access per resource.
Reusable endpoint configurations. Control who can instantiate or modify templates.
Multi-step automation pipelines. Scoped access for orchestration.
Organization Multi-Tenancy
Complete isolation between organizations. Every request is scoped. Every query is bounded.
Users in Org A cannot see or access Org B resources. All database queries scoped by org UUID.
Users and robots must have an active RBAC entry for the org. Deleted users cannot re-authenticate.
Every request requires X-Org-Id or X-Org-Uuid header. Organization context embedded in JWT claims.
Usernames are unique per organization. The same username can exist in multiple orgs as separate identities.
Unified Across Every Endpoint Type
One verify_rbac check for everything. No per-endpoint-type auth logic. Databases, LLMs, APIs, and functions share the same identity model.
MCP Agent Authentication
MCP agents inherit the calling user's identity. No separate credentials, no elevated privileges. Agents operate exactly as the user who invoked them.
The user's JWT is extracted from the request and passed through to every MCP tool call and relay operation.
Agents can only access endpoints the user has RBAC permissions for. No implicit privilege escalation.
Organization UUID is forwarded on every backend call via headers. Multi-tenancy enforced end-to-end.
Each MCP connection gets a unique session. Sessions are validated on every request to prevent cross-session access.
Users can register external MCP services with their own bearer tokens, stored securely and scoped to their identity.
Before granting tool access, Eden verifies the user owns the MCP endpoint and belongs to the correct organization.
Security Properties
Defense in depth across every layer of the auth stack.
Tokens signed with HMAC-SHA256 for tamper-proof authentication
Per-user random salt combined with SHA-256 hash — plaintext never stored
Robot API keys hashed on creation. Plaintext returned once, then discarded
JWT expiration configurable per deployment. Default 1 hour with refresh support
Each level inherits all permissions below it. No privilege escalation possible
Redis for sub-millisecond lookups, PostgreSQL as source of truth
Ready to Secure Your Data Stack?
Unified auth and RBAC for every endpoint. Get started with Eve today.