Question 1

How does MACAW integrate with my identity provider?

Accepted Answer

MACAW's Identity Bridge connects to your existing IdP via standard protocols (OIDC, SAML). When users authenticate through your IdP, their JWT tokens flow to MACAW, which extracts claims and binds them to policies.

Supported IdPs:
- Okta
- Auth0
- Azure AD / Entra ID
- Google Workspace
- Keycloak
- Any OIDC-compliant provider

Question 2

Is MACAW a replacement for Okta/Auth0?

Accepted Answer

No - MACAW extends your identity provider, not replaces it.

| Layer | What It Solves | Examples |
|-------|----------------|----------|
| Identity (Okta/Auth0) | Who is this person? | Authentication, SSO, directory |
| Agentic Access Control (MACAW) | What can their AI do? | Policy enforcement, workflow governance, crypto audit |

Okta tells you Alice is authenticated. MACAW tells you Alice's AI agent can only use GPT-3.5, access public documents, and make 100 calls per hour.

MACAW integrates

Question 3

What is the Identity Bridge?

Accepted Answer

The Identity Bridge is MACAW's component that connects to your IdP. Configure it in Console → Settings → Identity Bridge:

1. Select your IdP provider
2. Enter your IdP configuration (issuer URL, client ID, etc.)
3. Define claims mapping (which JWT claims map to MACAW attributes)
4. Test the connection

Once configured, user JWTs from your IdP are automatically recognized by MACAW.

Question 4

How do user roles map to MACAW policies?

Accepted Answer

Through claims mapping. Your IdP includes claims in the JWT (like role, department, groups). MACAW maps these to policy attributes:

yaml
claims_mapping:
  role: principal.role
  department: principal.department
  groups: principal.groups

Then policies reference these:
json
{
  "policy_id": "role:developer",
  "constraints": {
    "parameters": {
      "llm:": {"model": ["gpt-4"]}
    }
  }
}

Users with role: developer in their JWT get this policy applied automatically.

Question 5

What is claims-based policy binding?

Accepted Answer

Claims-based policy binding means policies are automatically applied based on JWT claims - no manual user-to-policy assignment needed.

Example flow:
1. Alice logs in via Okta → gets JWT with {"role": "engineer", "team": "backend"}
2. Alice's app passes JWT to MACAW adapter
3. MACAW extracts claims, finds matching policies (role:engineer, team:backend)
4. Policies compose automatically
5. Alice's AI operations are governed by combined policy

Add a new team member? They get the right policies au

Question 6

Can I switch identity providers without code changes?

Accepted Answer

Yes. Your application code doesn't change - it just passes the JWT to MACAW. The Identity Bridge configuration determines how to validate and map tokens.

To switch IdPs:
1. Configure new IdP in Console → Settings → Identity Bridge
2. Update claims mapping if claim names differ
3. Your app code stays the same

Question 7

How does MACAW handle multi-user AI applications?

Accepted Answer

Use bind_to_user() or pass jwt_token to bind each request to a specific user:

python
 Each user gets their own policy enforcement
client = SecureOpenAI(
    app_name="shared-app",
    jwt_token=current_user_jwt
)

Different users hitting the same app get different permissions based on their identity and claims. Alice might be allowed GPT-4; Bob might be restricted to GPT-3.5.

Question 8

Can different users have different AI permissions?

Accepted Answer

Yes - that's the core value proposition. Policies bind to identity claims:

- Alice (role: manager) → can use GPT-4, unlimited tokens
- Bob (role: intern) → can use GPT-3.5, max 1000 tokens
- Carol (role: contractor) → can only use approved tools, no LLM access

All using the same application code. Permissions follow the user, not the app.

Question 9

How do I implement per-user access control for AI?

Accepted Answer

1. Configure your IdP in Console → Settings → Identity Bridge
2. Define claims mapping
3. Create policies that reference claims (role:X, team:Y)
4. Pass user JWT to adapter:

python
client = SecureOpenAI(
    app_name="my-app",
    jwt_token=user_jwt_from_your_idp
)

MACAW handles the rest - extracting claims, finding policies, enforcing per-user.

Question 10

What happens if a user has no matching policy?

Accepted Answer

MACAW implements Zero Trust - no policy means no permission. Every operation must be explicitly authorized.

Practical policy inheritance: You don't need a unique policy for every user or app. Policies inherit through your organizational hierarchy:

Company → Business Unit → Team → User → App

If Alice has no user-level policy, she inherits from her team. If the team has no policy, it inherits from the BU, and so on.

Why this scales: Naive policy specification is O(M users × N resources) - un

Identity Integration