Skip to main content

Organization console

Your organization, in the live service.

Everything here is read from and written to the EOS service under your own sign-in. A change you make is recorded on your organization's chain with your name and the time. What you cannot do with your role is said so, by name.

Organization…
Your role…
Members…
Connections…
Service build…

You are not a member of an organization yet

An owner or admin of your organization invites you by the email you sign in with. Once they have, join here. Where your organization has an active EOS plan, that email must also be on its roster, unless you were invited as an external party. Organizations are opened under a master services agreement; write to founder@assetshopenterprise.com to begin.

Members

Roles are owner, admin, buyer, controller and member (Minerva's table). An organization always keeps at least one owner. An agent principal is listed and never managed here.

Reading members…

AssetShop does not send the email. Add the person to your roster first, then tell them to sign in at assetshopenterprise.com with that work email and open this console; the join button appears for them. A person not on your roster cannot join.

Open invitations

Reading invitations…

Single sign-on

SAML 2.0 or OpenID Connect through Identity Platform, configured for your organization at onboarding. Name the provider, claim your email domains, prove each with a DNS TXT record, and then, from a session that itself came through the provider, require it for everyone. The public sign-in page resolves a provider only for a proved domain.

Reading sign-on settings…

Provisioning (SCIM 2.0)

Okta, Microsoft Entra ID and other providers create, update and deactivate members under a token you mint here. A provisioned person is a pending membership until their first sign-in; deactivation removes access at once. Provisioning grants up to admin and never owner. At most two tokens are active.

Reading tokens…

Shown once. Give it to the identity provider as the SCIM bearer token, then close this.

Set up in the identity provider
  1. SCIM base URL: . Authentication: OAuth bearer token (the token above). Content type application/scim+json.
  2. Map userName to the work email (the only required attribute); optionally externalId, name, displayName, and roles (value one of admin, buyer, controller, member).
  3. Assign users or groups in the provider; the first push creates them as invitations here. Deprovisioning (active=false or delete) removes their membership immediately.
  4. Groups are the five role groups (role_owner, role_admin, role_buyer, role_controller, role_member); adding a user to one sets the role. Group creation is refused by design.

Connections

A connection is your organization's declared use of a live connector: the families it carries, its time zone and currency, how fresh it must stay, and, where the connector needs one, the Secret Manager reference of its credential (never the credential itself). A warehouse connection also names its read-only SELECT and the function template it feeds; run it here or on its freshness schedule.

Reading connections…

Signed events, to your systems and channels

Register a receiving system, allow its host, and subscribe it to events. A subscription names the shape its receiver reads: signed canonical JSON, a Slack incoming webhook, or a Microsoft Teams workflow webhook. Only declared fields leave; every delivery is signed with the system's key.

Receiving systems

Reading systems…

Shown once. This system's signing key; store it in the system.

Allowed destinations

Reading…

Subscriptions

Reading subscriptions…

Recent deliveries

Reading deliveries…

Templates and documents

The ten function templates and the documents of the engineering release are released under your master services agreement, watermarked to your organization and recorded on the release chain. Each template comes as CSV or as a workbook whose Read me sheet states every column's rule.

Reading the vault…

The chains

Every change above is hash-chained per organization. These are verified by the service on each read.

Membership

…

Connections and deliveries

…

Gateway and events

…

Vault releases

…