NepticAgent Identity Broker · AI Control Plane

Every model call — authenticated, authorized, metered, logged.

The choke point every AI agent passes through. Sign in with your organization's identity provider; your access is decided by your role, and every turn is sealed into a tamper-evident ledger.

Human-rooted identity. Short-lived, task-scoped agent credentials — never a long-lived key.

Role-based access. Your Entra role decides which models you may call.

Provable data sovereignty. Sensitive data is blocked from leaving the VPC — per turn.

SSO via Microsoft Entra ID (OpenID Connect) · single-tenant or multi-tenant SaaS

Sign in to your workspace

Enter your organization, then continue with Microsoft.

Organization Your workspace name (e.g. acme). New here? Set up an organization.

Set up your organization

Create your Neptic workspace. You'll register your Entra SSO next.

Setup order: create the workspace, then register your Entra directory, then your users sign in with Microsoft.

Organization name

Your admin email

Register Microsoft Entra SSO

For —. From your Entra app registration.

Redirect URI — register this in Entra

—

How to get these from Microsoft Entra ID

Go to entra.microsoft.com → App registrations → New registration. Choose Accounts in this organizational directory only (single tenant) and name it e.g. Neptic.
Open Authentication → Add a platform → Web and set the Redirect URI to the value shown above.
Open Certificates & secrets → New client secret, then copy the secret Value (not the Secret ID) into Client secret below.
Open Overview and copy Directory (tenant) ID and Application (client) ID into the fields below.
Under App roles → Create app role, create the roles you want — the Value is yours to choose (Neptic.Engineering, Neptic.HR are just a convention). Then in Enterprise applications → your app → Users and groups, assign each user to one. Copy each Value into the Role map below exactly: the map matches that string, and a row that matches no App Role admits nobody.

Directory (tenant) IDFrom the app's Overview page.

Application (client) IDFrom the app's Overview page.

Client secret Value (not the Secret ID)Paste the Value column from Certificates & secrets — shown only once, right after you create it.

Map Entra app-roles → Neptic roles

On the left, the exact Value of an App Role that exists in your app registration — copy it from Entra; creating a row here does not create it there. On the right, the Neptic role it grants.

Users whose App Roles match none of the above Granting a role here admits every user in your directory who can reach the app. Deny is the stricter choice, and means only the App Roles above get in.