◈
SSO & SAML
OIDC authorization-code sign-in is implemented, with an optional SAML identity-provider metadata configuration. Real endpoints back this — /auth/sso/status, /auth/sso/start, and /auth/sso/callback.
Enterprise
SSO, provisioning, and audit logs for pilot rollouts
Escape AI ships real SSO, SCIM user provisioning, and audit logging, built for teams ready to pilot it beyond a handful of individual accounts.
⇄
SCIM provisioning
SCIM v2 user provisioning is implemented — ServiceProviderConfig, Schemas, ResourceTypes, and full Users CRUD, with group-role mapping via configured group mappings. Group mutation itself isn't implemented yet; the Groups endpoint is currently read-only.
▤
Audit logs
Every agent action and account-level change is logged, so admins have a real record of what happened and when.
⌂
Self-hosted option
A documented Docker Compose deployment path lets teams run the full stack on their own infrastructure instead of the hosted service.
i
Honest scope
These are MVP-pilot features: SSO and SCIM are both off by default (SSO_ENABLED=false, SCIM disabled by default) until an admin turns them on, and a password-based owner/admin account is always preserved for break-glass recovery. This isn't positioned as battle-tested at large scale — it's ready for pilot rollouts with a real team.
Rolling out Escape AI to your team?
Talk to us about SSO, SCIM, and a pilot rollout that fits how your org actually works.