Identity context
Bind evaluation to tenant and principal.
Evaluate identity, device, application, session, and consequence together.
2AYE implements access-policy evaluation, passkey step-up, device posture, session revocation, and explained decisions. Complete application SSO and VPN adapters remain separate availability items.
- Identity context
- Device context
- Step-up
What you can evaluate
Contextual access with explicit outcomes.
Device context
Use current evaluated posture and policy version.
Step-up
Require stronger proof for sensitive applications.
Response
Deny, challenge, approve, or revoke with evidence.
Follow Access management from identity to evidence.
Each consequential action moves through the same six control points. See where 2AYE evaluates authority, requests human review, and preserves the outcome.
- 01IdentityWho or what is acting
- 02IntentSigned purpose and limits
- 03PolicyDeterministic evaluation
- 04ApprovalA named human when required
- 05ExecutionSingle-use grant, redeemed at the resource
- 06EvidenceReceipt joined to the audit chain
A practical adoption path
Start with one consequential workflow. Prove the boundary before expanding.
Assess
Document the environment, threat model, and integration boundary.
Design
Select protocols, signals, policies, and failure behavior.
Validate
Test vendor-specific APIs, tenant isolation, and abuse paths.
Release
Mark available only after deployed end-to-end verification.
What this includes
- Access-policy evaluation bound to tenant and principal
- Passkey step-up
- Device posture and policy version in decisions
- Session revocation with explained decisions