> ## Documentation Index
> Fetch the complete documentation index at: https://docs.introw.io/llms.txt
> Use this file to discover all available pages before exploring further.
# Access & Security
> Control who can see and do what, on both sides of the partnership - internal team roles and permissions, partner team roles, and single sign-on for your team and your partners.
export const Headless = ({prompts = []}) => {
const PromptRow = ({prompt}) => {
const [copied, setCopied] = useState(false);
const copy = () => {
try {
navigator.clipboard?.writeText(prompt);
} catch {}
setCopied(true);
setTimeout(() => setCopied(false), 1600);
};
return ;
};
return <>
Introw is headless by design: run everything here in plain language from Claude, ChatGPT,
Slack, Teams, or your own CRM through Introw's MCP server, with every
action written straight back to your CRM source of truth. The portal is one surface, never the only one.
{prompts.length > 0 ? :
The agentic playbook - lifecycle deep dives and a Claude Code skill library that run your partner program
from Claude, ChatGPT, Slack, and your CRM.
}
;
};
> Every partner program runs on trust, and trust starts with access. Decide exactly what your internal team can do, what each partner's people can do, and how everyone signs in, all configured by your team without engineering.
## What this area does
Access and security covers two capabilities. Team management is where you invite your internal team,
assign roles built from clear permission categories, and limit users to the partners they own. It is
also where you define partner team roles and assign the people who manage each partner. Single sign-on
lets your own team and your partners log in through your identity provider, so access follows your
existing security policies.
Both are configured by partner operations and admins directly, with no code, and the permissions you
set apply consistently across every surface a user touches.
## Why it matters
* **Low total cost of ownership** - Roles, permissions, and SSO are configured by your team, not engineering.
* **CRM-native** - Partner and visitor access is scoped to the CRM-synced data each partner owns, and no external user ever needs a CRM seat, so the CRM admin keeps control of who can reach which records.
* **Trust and accuracy** - The right people see the right data, and sign-in follows your security policy.
These permissions also scope Introw's AI agents. When an assistant connects over [MCP](/features/developer/mcp), its data access follows the signed-in user's partner scope - a partner's assistant reaches only that partner's data. What an agent may do on its own is governed by a vendor-configured [capability matrix](/headless#governance-and-trust), with sensitive actions kept behind human approval.
## How it fits together
Sign-in and roles govern every surface a user touches, including AI agents:
```mermaid theme={"theme":{"light":"github-light","dark":"github-dark"}}
flowchart LR
idp["Your identity provider"] -->|"SSO"| introw["Introw"]
roles["Roles and permissions"] --> introw
introw --> surfaces["Every surface"]
introw --> agents["AI agents, same scope"]
```
## Capabilities
Internal roles, permissions, and partner team roles.
SAML sign-in for your team and your partners.
## Who works in this area
Owns identity, access, and security policy.
Configures roles and partner team access.
## Headless
## All guides
{/* ROLLUP:START - generated content goes here */}
Connect your identity provider, map SAML attributes to user fields, set a default role, and switch your team to single sign-on.
Let partners sign in to your portal through their own identity provider with SAML, using your portal's service provider URLs and the SSO-only login switch.
Use one Introw login to create, join, and switch between multiple independent organisations, with data kept strictly siloed.
Build a reusable role from permission categories, choose an access type, optionally scope it to a user's assigned partners, then set notifications and assign users.
Add a colleague to your team in the right role, understand paying vs CRM-only seats, and manage their status from invited through active.
Define the roles people hold on a partner, sync them to your CRM as a single owner or a multi-member field, and assign people one at a time or in bulk.