Identity & Auth

Identity comes from one shared Zitadel instance; authorization comes from the authz service and the acl table in each environment's database.

• Accounts are invite-only. Nobody can self-register.
• Signing in provisions nothing: no personal organization, no role.
• Organizations are created by platform admins; access is granted from the portal's Team page.

Pages:

• Zitadel: the identity provider, projects, login policy
• Authz: roles, who can grant what, the first platform admin
• Onboarding a customer from the portal: creating an organization and its accounts