DEMO · labelled fixtures · no authoritative writes
Demo mode·Every screen here is simulated in your browser — 24 users, 18 devices, 10 apps, no backend, provider or device. Administrative builds require an Authentik-backed BFF and never expose bearer tokens to browser JavaScript.
Entitlements, separation-of-duties controls, approval evidence, time-bound grants and certification campaigns.
Zero-standing privilege: privileged access is capped by the entitlement, requires two independent approvers, and expires automatically. Toxic combinations are blocked before approval.