Workspace roles and policies

The Chancery

The Chancery is identity and access for your Zipper workspace, built on Palace RBAC rather than bolted on beside it. Resources sit in a simple hierarchy — workspace → project → service — and every request is judged by an explicit policy: who (a teammate, a key, an app) may do what (a console action or an API verb) to which resource, under which conditions (project, hostname, time window, or a required MFA claim). Deny always beats allow. Write a change, run it in the simulator against the last twenty-four hours of real audit events to see what it would have blocked or allowed, then publish with one click; policy history keeps the trail and rollback is one action. Ask the plain question — “who can reach The Cellar?” — and get the answer as a list. Honest limits, stated plainly: this is workspace policy, not an identity provider — no SAML or OIDC single sign-on, no directory sync, no organization-wide MFA mandate. It answers “what may happen here,” not “who are you.”

In plain English — The rulebook for your workspace: decide which teammates, keys, and apps may touch which services, under which conditions — with a plain-English report of who can reach what, and a test run before you publish.

• ▸ Workspace → project → service hierarchy
• ▸ Allow and deny policies with conditions
• ▸ Policy simulator over real audit events
• ▸ Policy history with one-click rollback
• ▸ Access reports: “who can reach this?”
• ▸ Owner · Steward · Warden · Scribe · Guest roles

Auto-provisioned on every new zone. Read the The Chancery docs, including use cases and API examples. Manage it from the dashboard after you create an account.