FAQ
Frequently asked questions
The short version. For contract-level detail, the full reference lives in the docs behind sign-in.
The platform
Which identity providers does Eniyan work with?
Any identity provider that speaks OIDC or SAML 2.0, including Okta, Microsoft Entra ID, Auth0, OneLogin, Ping Identity, and JumpCloud, with SCIM 2.0 for provisioning and group push. Eniyan is additive: nothing about your existing IdP setup changes.
Do we have to replace our identity provider?
No. Eniyan federates to it. Your IdP stays the system of record for people; Eniyan becomes the identity provider for your agents, kept in sync over OIDC/SAML for sign-in and SCIM 2.0 for provisioning. Everything is additive and per-org opt-in: disconnecting the IdP returns you to exactly the setup you have today.
Do we need a workforce identity provider to use Eniyan?
No. Federation is optional and enabled per-org. Without one, admins sign in with a password and assign each agent's permissions directly, and agents still authenticate with standard OAuth 2.0 — presenting their signed Eniyan credential for a 10-minute access token scoped to exactly those permissions. The full identity and Risk Management stack works the same: signed agent credentials, scope enforcement, just-in-time activation, post-task attestation, and a tamper-evident audit trail. Connecting an IdP later adds single sign-on and automatic joiner-mover-leaver, so an agent's access tracks its operator's live groups and lapses the moment they're offboarded. You can start without one and federate whenever you're ready.
How long does connecting our IdP take?
It's configuration, not a migration. OIDC needs a discovery URL and client credentials; SAML needs your IdP's metadata; SCIM needs a token minted from the dashboard and pasted into your IdP's provisioning settings. There's a built-in connection test, and nothing about your existing IdP applications changes.
How do agents get access without service accounts or shared secrets?
Through delegation, not credentials in a vault. An operator delegates the IdP groups they currently hold to an agent; the agent exchanges its signed credential for a 10-minute OAuth token scoped to exactly those live entitlements. There is no static secret to rotate, and the agent can never out-rank the human behind it.
How do agents authenticate to my services?
With standard OAuth 2.0. An agent presents its signed Eniyan credential and receives a 10-minute access token scoped to its operator's live delegated entitlements. No SDK required; existing OAuth tooling works unchanged.
Can an agent hold a permission its operator doesn't have?
No. Delegations must be a subset of what the delegating operator currently holds, and a delegation lapses the moment the operator loses the underlying group. An agent's authority is always a live subset of a real human's live authority.
What happens to an operator's agents when they're deactivated in our identity provider?
The offboarding cascade runs automatically. SCIM deprovisioning suspends the operator, every agent anchored to them suspends with it, and every entitlement they delegated lapses. Because tokens live only 10 minutes, their agents lose all access within one token lifetime.
Transaction governance
What is agentic transaction governance?
The control layer that lets a platform safely accept transactions from AI agents acting on a consumer's behalf: verifying that a real human freely consented, constraining every transaction to explicit caps, budgets, and counterparties inside the token itself, and revoking an agent's authority in seconds.
How is this different from giving an agent a saved card or a session cookie?
A card or cookie is all-or-nothing standing authority. A consumer delegation is scoped authority: a specific tier, per-transaction cap, windowed budget, and approved counterparties, granted in a consent ceremony you can score and audit, compiled into a token that expires in five minutes.
What is a Consent Assurance Level (CAL)?
CAL scores the quality of the grant itself, the way AAL scores an authentication. It weighs presence, freedom, session integrity, and comprehension, and signals of duress or coercion cap the score outright. Higher delegation tiers demand higher-assurance consent.
How fast does revocation take effect?
For platforms that introspect, immediately: a revoked delegation reports inactive on the very next call, even for an unexpired token. For anything that only checks token expiry, the bound is one token lifetime: five minutes.
Do you see our customers' personal data?
No. Consumers are pairwise pseudonymous IDs that only your platform can map back to a person. You keep the customer mapping; we never hold names, emails, or card numbers in the delegation path.
Does this replace our payment processor or fraud stack?
No. Eniyan governs authority before authorization: whether this agent, for this customer, under this consent, may attempt this transaction at all. Your PSP still moves the money and your fraud stack still scores it.
Pricing & plans
How is Eniyan priced?
One platform, two numbers: a flat monthly platform fee per tier (Team $199, Business $499, Scale $999, Enterprise custom) plus a per-agent monthly rate ($4, $3, and $2 respectively). That is the same way your identity provider prices people, applied to agents. Every tier includes the full platform; what climbs the ladder is operational depth, never the core security features.
Can I start free and upgrade later?
Yes. Create a free account. No card required. Connect your identity provider and register agents on a free trial; upgrading is self-serve, and the per-agent rate drops as you move up.
I'm an existing customer. Does my plan change?
No. Existing subscriptions continue unchanged on their current terms. Same price, same features, no action needed.