CAIN-42 CAIN Studio
Sign inGet started
Menu

CAIN-42 · For large organisations

Single sign-on & SCIM

Sign in with your company login (Okta, Entra, Google) and keep users in sync automatically.

Last reviewed 2026-10-01

Live   Core platform · Platform feature

What it is

Sign in to CAIN Studio with your company identity provider (OIDC) and keep users in sync with SCIM 2.0.

Where it fits

Part of For large organisations: Compliance, private deployment, SIEM and advisory. Every CAIN-42 product runs behind the same rule: an AI agent's action is checked before it runs (identity, authority, policy, risk), decided as allow, hold for a human, or block, and recorded as signed evidence. Unknown or error never becomes allow.

Use it

Live now

Checked from your browser when this page opened, not from a cached list.

Fire a real decision

Send an action through the live CAIN-42 pipeline from this page, with no account, and watch every stage decide. This is the same pipeline every product here sits behind; it runs for a throwaway demo tenant and is rate limited.

For AI engineers

Every product sits behind one decision path: your agent proposes an action with the exact arguments, CAIN runs it through identity, authority, policy, risk, trust and quorum consensus, and answers ALLOW, REQUIRE_APPROVAL or DENY with an Ed25519-signed record. A timeout, outage or unknown verdict never becomes ALLOW. A brand-new agent has no trust history, so its first actions usually come back REQUIRE_APPROVAL.

Python (zero dependencies)

pip install https://cainstudio.online/cainstudio-0.3.0-py3-none-any.whl
export CAIN_API_KEY=...   # free key: https://cainstudio.online/signup

import cainstudio

@cainstudio.guard()
def transfer(amount_usd: float, to: str) -> str:
    ...  # runs only if CAIN allows this call, with these arguments

try:
    transfer(5000, "acme")
except cainstudio.ApprovalRequired as e:
    print("held for a human:", e.approval_id)
except cainstudio.ActionBlocked as e:
    print("refused:", e.decision.reasons)
except cainstudio.CainUnavailable:
    print("CAIN unreachable: not run")   # fail-closed

See a real decision with no account

cainstudio try          # live pipeline, stage by stage
cainstudio try --list   # the other attack scenarios

MCP clients (Claude Code, Cursor)

claude mcp add --transport http cain https://cainstudio.online/mcp

More: Python SDK · TypeScript SDK · framework integrations · AI quickstart · decision signing key

Tested guarantees in this area

Every rule in these niches has its own page with its recorded result.

Related

Full documentation

The complete reference, also at /docs/sso.

Single sign-on and SCIM#

Let your team sign in to the CAIN console with your company's identity provider, and let that provider add and remove people automatically. It works with Okta, Microsoft Entra ID, Google Workspace, Auth0, Keycloak, or any OpenID Connect provider. Owners and admins set it up; nobody else can.

1. Register the provider#

In your provider, create an OIDC web application. Set its redirect URI to https://cainstudio.online/sso/callback, then give CAIN the issuer, client id and client secret:

curl -s -X PUT https://cainstudio.online/fabric/sso -H "X-API-Key: $CAIN_API_KEY" \
  -H 'content-type: application/json' \
  -d '{"issuer":"https://acme.okta.com", "client_id":"0oa...", "client_secret":"...",
       "default_role":"viewer", "jit":true, "allowed_domains":["acme.com"]}'

The answer includes login_path, for example /sso/sso_3f9c.../login. That is the sign-in link for your team. The client secret is stored encrypted and never returned.

first sign-in, with default_role (viewer or member). Without jit, people must be invited or provisioned first.

preferred_username.

2. Sign in#

Opening the sign-in link sends the browser to your provider, then back to CAIN, which opens the console as that person, with their role. Behind the scenes:

10 minutes.

none or shared-secret algorithms), along with issuer, audience, expiry and nonce.

3. Provision with SCIM (optional)#

curl -s -X POST https://cainstudio.online/fabric/sso/scim-token -H "X-API-Key: $CAIN_API_KEY"

Give your provider the base URL https://cainstudio.online/scim/v2 and the token, which is shown once. The provider can then create, update, deactivate and delete members (SCIM 2.0 Users). Roles come from roles[].value: viewer or member. A request for admin is refused. Deactivating someone ends their console access on their very next request, and just-in-time joining cannot bring them back.

Limits#

existing way.

Try CAIN-42 on your own agents

Create a free account and every new account starts with a 7-day trial of the full platform. Or try the sandbox first, with no account at all.

Create a free account →  ·  Try the sandbox  ·  See the whole ecosystem