SSO, IP allowlists, and advanced access policy
Understand advanced access-policy questions without assuming every control is visible in every workspace.
Outcome
You can identify which access policy you need and prepare a safe support request if the control is not visible.
Your progress
Mark each step as you complete it. This is saved only in this browser.
0 / 3 steps complete
Before you start
Visual frame
Review asset
Advanced access policy storyboard
Synthetic access frame only. It keeps SSO, IP allowlists, MFA policy, and advanced controls plan-, role-, and workspace-dependent.
Synthetic frame
Access policy
One policy type per support request.
SSO, IP allowlists, and advanced access policy boundary frame
Reference frame for a deferred or gated topic. It routes users to current supported workflows and safe escalation.
Guided steps
Follow the task, then check the result.
Name the policy type
Separate SSO, MFA, IP allowlist, role management, and package-access questions. Each one belongs to a different setup or troubleshooting path.
Check visible controls and role
Look for the setting in account-visible security or organisation settings. If it is not visible, do not assume it is unavailable or broken.
Prepare a safe access-policy request
Send the policy type, organisation role, visible screen, and desired outcome. Do not send tokens, cookies, full IP lists, or private user data by default.
Branch questions
Are you trying to complete a supported Redactorr workflow right now?
Does your screen or plan appear to disagree with this article?
Completion check
Support boundary
Support can use by default
- Article slug and selected boundary question.
- Screen, plan, or workflow name if visible.
- Browser, viewport, and account-visible state.
- Synthetic example or already-redacted sample only after review.
- Intent ID
- Article slug
- App route
Requires your consent
- User-written description
- Email address
- Explicit attachment
- Redacted sample
- Support bundle previewed to the user
Not collected by default
- Raw original document text
- Full local file paths
- Pasted private content
- Unmasked screenshots
- Replay capture
Safe support summary
Copy a scrubbed handoff.
Redactorr KB support summary Article: /knowledge-base/advanced-access-policy Selected issue: A contracted access control is not visible to an owner/admin. Playbook progress: 0/3 steps marked complete Safe context to include: - Article slug and selected boundary question. - Screen, plan, or workflow name if visible. - Browser, viewport, and account-visible state. - Synthetic example or already-redacted sample only after review. - Intent ID - Article slug - App route Requires explicit consent: - User-written description - Email address - Explicit attachment - Redacted sample - Support bundle previewed to the user Do not include by default: - Raw original document text - Full local file paths - Pasted private content - Unmasked screenshots - Replay capture User note: - Describe the step and symptom without pasting raw document text, secrets, files, or restoration material.
Article details
SSO, IP allowlists, and advanced access policy
Understand advanced access-policy questions without assuming every control is visible in every workspace.
Current Boundary
Authentication uses WorkOS AuthKit, and advanced controls such as SSO, IP allowlists, MFA policy, or organisation access settings should be treated as plan-, role-, and workspace-dependent unless visible in your account or contract.
Outcome
You can identify which access policy you need and prepare a safe support request if the control is not visible.
Before You Start
- Use an owner or admin account where possible.
- Know whether the question is about login, role access, network access, or share/package access.
- Do not send identity tokens, session cookies, or screenshots containing personal data.
1. Name the policy type
Separate SSO, MFA, IP allowlist, role management, and package-access questions. Each one belongs to a different setup or troubleshooting path.
Check before you continue: The access question names one policy type.
2. Check visible controls and role
Look for the setting in account-visible security or organisation settings. If it is not visible, do not assume it is unavailable or broken.
Check before you continue: You know whether the control is visible for your role.
3. Prepare a safe access-policy request
Send the policy type, organisation role, visible screen, and desired outcome. Do not send tokens, cookies, full IP lists, or private user data by default.
Check before you continue: Support can route the request without receiving sensitive authentication material.
Completion Check
- The access policy type is clear.
- Role and visible controls were checked.
- No tokens, cookies, or private user data are included.
Safe Examples
- Owner account cannot see IP allowlist settings for the organisation.
- We need SSO guidance for example.test domains, without identity tokens.
If You Need Support
Contact support when:
- A contracted access control is not visible to an owner/admin.
- An access policy blocks legitimate users and the visible error is unclear.
Include only support-safe context:
- Article slug and selected boundary question.
- Screen, plan, or workflow name if visible.
- Browser, viewport, and account-visible state.
- Synthetic example or already-redacted sample only after review.
Still stuck?
Copy a safe article handoff.
Start support with the article, the issue, and safe context. Raw document text, files, restoration material, and unredacted screenshots stay out unless you explicitly choose otherwise.
- Article slug
- Selected issue
- Screen name
- Action name
Redactorr support case Source: Article playbook: advanced-access-policy Route: /knowledge-base/advanced-access-policy Selected issue: A contracted access control is not visible to an owner/admin. Safe context: - Article slug and selected boundary question. - Screen, plan, or workflow name if visible. - Browser, viewport, and account-visible state. - Synthetic example or already-redacted sample only after review. - Article slug - Selected issue - Screen name or article section - Action name Only include with explicit consent: - User-written description - Email address - Explicit attachment - Redacted sample - Support bundle previewed to the user Do not include by default: - Raw original document text - Full local file paths - Pasted private content - Unmasked screenshots - Replay capture - Hidden diagnostic uploads User note: - Describe what you tried and what happened. Do not paste raw document text, secrets, files, restoration material, or unredacted screenshots.
Support case builder
One case format, wherever you start.
This is the same support case shape used by diagnostics and article handoffs.
- Article slug and selected boundary question.
- Screen, plan, or workflow name if visible.
- Browser, viewport, and account-visible state.
- Synthetic example or already-redacted sample only after review.
- Article slug
- Selected issue
Private material belongs behind an explicit consent step, not in the initial case.
6 default exclusions