Deep Dive

Access and security

Choose the right identity, permission, and credential workflow

SQIP separates human access to the console from application access to Pulsar. Human access is evaluated for one tenant at a time. Applications receive time-limited credentials for one managed namespace.

Choose the correct credential

CredentialUsed byScope
SQIP user accountA person using the consoleThe person's role and additional permissions in each tenant
Tenant SSO sessionAn employee using a customer identity providerOne configured tenant and its default SSO role
Pulsar API keyAn application producing or consuming recordsOne tenant, ready cluster, and managed namespace
Connector credentialA managed connector accessing an external systemOne connector installation

Warning

Use your organization's approved secret manager for API keys, connector credentials, and OIDC client secrets. Do not place secrets in resource names, URLs, descriptions, support tickets, or audit searches.

  1. Start people with the narrowest standard role.
  2. Add only the tenant-specific permissions their work requires.
  3. Give each application its own API key and namespace scope.
  4. Set expiries and rotate credentials before they expire.
  5. Review access and credential changes in Audit Logs.
  6. Remove memberships and revoke keys when they are no longer needed.