Deep Dive
Access and security
Choose the right identity, permission, and credential workflow
SQIP separates human access to the console from application access to Pulsar. Human access is evaluated for one tenant at a time. Applications receive time-limited credentials for one managed namespace.
User management
Add tenant users, change their access, synchronize the identity directory, and remove memberships.
RBAC
Understand tenant roles, additional grants, effective permissions, and administrative boundaries.
Access guide
Find the permission required for each console and API operation.
API key creation
Issue and rotate namespace-scoped producer and consumer credentials.
Tenant SSO
Broker a customer's OIDC provider through SQIP's identity service.
Notifications
Configure encrypted email, Slack, and Microsoft Teams alert destinations.
Choose the correct credential
| Credential | Used by | Scope |
|---|---|---|
| SQIP user account | A person using the console | The person's role and additional permissions in each tenant |
| Tenant SSO session | An employee using a customer identity provider | One configured tenant and its default SSO role |
| Pulsar API key | An application producing or consuming records | One tenant, ready cluster, and managed namespace |
| Connector credential | A managed connector accessing an external system | One connector installation |
Warning
Use your organization's approved secret manager for API keys, connector credentials, and OIDC client secrets. Do not place secrets in resource names, URLs, descriptions, support tickets, or audit searches.
Recommended control pattern
- Start people with the narrowest standard role.
- Add only the tenant-specific permissions their work requires.
- Give each application its own API key and namespace scope.
- Set expiries and rotate credentials before they expire.
- Review access and credential changes in Audit Logs.
- Remove memberships and revoke keys when they are no longer needed.