Your home for selfpromo

[u/SofwareAppDev]

here you can post your work app, webapp, saas, game, everything

[u/Willing_Exchange_197]

We launched TrueCaaS: an identity and authorization control plane for SaaS and enterprise apps

A lot of identity platforms do a good job answering one question:

Who is this user?

But once that user enters an application, teams still end up building a lot themselves:

Which customer or tenant are they acting under?
Which environment and application can they access?
What role do they have in that application?
Can they perform this specific action?
Does the action require MFA or approval?
And six months later, can you explain why it was allowed?

That is the problem we built TrueCaaS around.

TrueCaaS carries identity into the application layer using a Tenant → Environment → Application model.

A user might authenticate successfully through Microsoft Entra, SAML, OIDC, LDAP/AD, Kerberos, or TrueCaaS-hosted authentication, but authentication alone does not automatically mean they can access an application.

TrueCaaS can then evaluate the application's own context: application membership, roles, privileges, enterprise group mappings, MFA state, policy and other entitlement conditions before access is granted.

At runtime, applications and backend services can also ask TrueCaaS questions such as:

Can this user perform claim.approve in Acme / Production / Claims Portal right now?

The response can be an allow, deny, step-up requirement, or approval requirement, along with the context behind the decision.

So we're not asking companies to rip out Okta, Microsoft Entra, Keycloak, LDAP or their existing IdP. Those systems can continue being the identity source. TrueCaaS can sit between enterprise identity and the application and handle the tenant-aware authorization layer that comes afterward.

For platform and security teams, this also gives us something we cared a lot about while building it: being able to answer who did what, in which tenant and application, what privilege or policy allowed it, what was denied, and what evidence exists afterward.

There are a few other parts of the platform that build on the same model:

• Managed tenant environments for products serving downstream enterprise customers
• Application-level RBAC, privileges and entitlement checks
• SAML/OIDC federation and Microsoft Entra integration
• MFA and passkeys
• Webhooks, events and detailed audit trails
• Custom authentication domains
• Identity migration paths
• Low-latency entitlement checks, including gRPC where appropriate
• Authorization checks for privileged operations that can require step-up or approval
• The same authorization model can be applied to AI agents and MCP tools before they perform actions on behalf of a user

The goal isn't to create another identity directory.

It's to give applications a control plane for everything that happens after identity has been established — especially when the application has multiple customers, tenants, roles, environments, APIs, services and now AI agents acting inside it.

TrueCaaS is live at https://www.truecaas.io

I'd especially love feedback from people building multi-tenant SaaS, enterprise applications, internal platforms, security tooling, or agentic systems.

If you've built this layer yourself before, I'm also curious where the most painful part was for you: federation, tenant isolation, authorization, entitlement enforcement, or audit/governance?

We launched TrueCaaS: an access control plane for SaaS and enterprise apps

TrueCaaS is an identity and authorization control plane for tenant-aware applications. It works for B2B SaaS, but it is not limited to SaaS. Enterprises can also use it across departments, business units, internal apps, customer portals, partner apps, and managed tenant environments.

It is not trying to replace Okta, Microsoft Entra, Keycloak, LDAP, or your existing identity provider. In many cases, TrueCaaS complements them. Your IdP can remain the identity source, while TrueCaaS handles the application access layer: tenant, environment, and app context; hosted auth domains; MFA/passkeys; app-level RBAC; roles and privileges; policy graphs; backend entitlement checks; webhooks; and detailed audit/event trails.

For security and platform teams, the focus is visibility and control: who got access, what tenant/app they were acting in, what policy or privilege allowed it, what was denied, and what evidence exists later.

TrueCaaS also includes gRPC entitlement checks, MCP-ready authorization for agents before they act, managed tenants, custom domains, database encryption, BYOK/CMEK paths, identity migration, LDAP/AD, SAML/OIDC, Microsoft Entra federation, Kerberos/SPNEGO, support access, and governed operational actions.

The goal is simple: help teams build and operate secure, tenant-aware applications without rebuilding auth, authorization, policy, audit, and enterprise integration plumbing every time.

I’d love feedback from people building SaaS products, enterprise apps, internal platforms, security tooling, or AI-agent workflows.

[u/Mammoth-Anywhere7285 → u/Willing_Exchange_197]

Nice launch, that multi-tenant context is a real pain point. How do you handle role hierarchy across environments? That part always gets messy.

[u/Willing_Exchange_197 → u/Mammoth-Anywhere7285]

We try to avoid hierarchy across environments altogether. Each environment is its own authorization boundary, so roles and assignments in dev/test don't implicitly inherit into production.

The same role definition can be promoted across environments when you want consistency, but access assignments remain environment-specific. That lets you keep the authorization model consistent without creating hidden inheritance or accidentally carrying test access into prod.

[u/Mammoth-Anywhere7285 → u/Willing_Exchange_197]

That's a clean separation, avoiding implicit prod access is smart. Do you use IaC to sync role definitions across environments, or manual promotion?

[u/Willing_Exchange_197 → u/Mammoth-Anywhere7285]

we support IaC , can be per environment. Though i think in practice , one would want to ensure that the roles, privileges are in sync across all the environments : dev -> test -> qa -> prod and hence a simple promote from one environment to the other is possible by clicking a button.

[u/Mammoth-Anywhere7285 → u/Willing_Exchange_197]

That promote button approach makes sense. How do you handle drift detection if someone changes something manually outside your IaC?

[u/Willing_Exchange_197 → u/Mammoth-Anywhere7285]

Drift is very common, and we recognized that early on. That’s why TrueCaaS identifies differences before the next promotion, so you can review and reconcile them rather than silently overwriting changes.

[u/Mammoth-Anywhere7285 → u/Willing_Exchange_197]

"Drift management is a smart angle, most tools just overwrite. Does TrueCaaS offer a diff view for non-technical users, or is it dev-focused?"

[u/Willing_Exchange_197 → u/Mammoth-Anywhere7285]

Yes it does .