Identity and access
The right access for each responsibility.
Let sales, product specialists, production and IT work on the same platform with clear boundaries around their authority.
Use your organisation’s identities
Use your existing identity provider — such as Google Workspace or Microsoft Entra ID, formerly Azure AD. Tomstok connects to your login service so employees use their company identity. Other login providers are assessed against their federation capabilities and your security requirements.
You own the login configuration in your AWS account. Everyday access and session renewal do not pass through Tomstok’s central administration. Google and Microsoft login each have a supported connection path.
The identity provider confirms who the user is. Tomstok then determines what that person may do, based on access and permissions you approve. A valid login therefore does not automatically grant access to product data, pricing changes or approvals.
Access you approve · roles · traceability
- Google Workspace
Company Google identity
- Microsoft Entra ID
Company Microsoft identity
- Other identity providers
Connection agreed with your IT team
Login verifies identity. Your permissions determine access.
Distinguish viewing, editing and approving
A salesperson may need to configure an order without being able to change the rules that determine buildability. A product specialist may maintain a draft while another person approves the new basis.
Tomstok’s permissions model distinguishes actions on resources. Read, write and delete access are separate. You assign separate permissions for binding sales, releasing a new basis and changes that broaden allowed product choices.
- Identity
Who is the person?
- Access you approve
Which resources and actions may the person use?
- Permissions for sensitive actions
Who may approve sensitive changes?
Support on your terms
Get support on your terms. You approve our support team’s task and access period, and the support engineer activates their role with a reason. Access is specific and traceable.
You can stop Tomstok support access directly in your environment, even when the central portal is unavailable. Access expires locally at the agreed end date, keeping you in control throughout the support engagement.
Prepare access before an outage
Prepare a controlled access route in case ordinary login fails. Named emergency users, permissions you approve and recovery material held by you give IT a practical recovery plan.
The setup is tested in your installation before use. You know both the procedure and its limits: who can act, which tasks their access covers and which outages the arrangement handles.
See Tomstok with your products in mind.
Talk to us about your product range and production requirements.