Platform IAM

Platform IAM exists because I kept watching the same problem show up in three different places. Job Search Studio, Compliance Studio, and Prompt Studio each needed login, session handling, and some notion of who's allowed to do what — and building that three separate times, slightly differently each time, is exactly the kind of thing that looks like three small shortcuts in the moment and turns into three inconsistent security models a year later.

So instead I built it once, as shared infrastructure: OIDC login flows, policy-based RBAC, and the organization/tenant model every other bounded context on this platform builds on top of. Getting the hard parts — token validation, policy evaluation, tenant isolation — right in one place meant none of the individual product teams had to solve authentication and authorization for themselves, or quietly get it slightly wrong under deadline pressure.

That bet paid off the way shared infrastructure is supposed to: job search, compliance, and prompts all adopted it rather than rolling their own, which is the actual measure of whether "build it once, share it everywhere" was the right call or just a nice idea on a whiteboard.

flowchart TB
    IAM["Platform IAM\nOIDC + policy RBAC +\norg/tenant model"]
    IAM --> JobSearch["Job Search Studio"]
    IAM --> Compliance["Compliance Studio"]
    IAM --> Prompts["Prompt Studio"]