Authentik is the selected shared staff identity platform for Affective Technologies services. Its IHNYC rollout is being commissioned; until the pilot is verified, current Cloudflare Access login methods remain authoritative in production.
Responsibility chain
flowchart LR PERSON["Staff member"] --> IDP["Authentik at sso.affectivetech.com"] IDP --> ACCESS["Cloudflare Access"] ACCESS --> APP["House Desk or Pub"] APP --> ROLE["Product-local role and permissions"]
| Layer | Responsibility | Not its responsibility |
|---|---|---|
| Authentik | Account identity, login, and MFA | House Desk or Pub permission decisions |
| Cloudflare Access | Edge admission and a signed identity assertion for each existing application | Product actions and roles |
| House Desk | Exact D1-backed roles, custom grants, recovery access, and authorization audit | Pub permissions |
| Pub | Pub roles, permission bundles, scoped operator access, and authorization audit | House Desk permissions |
Cloudflare continues to issue the JWT that each application verifies. Connecting Authentik as an upstream OIDC provider therefore does not require either product to become a direct Authentik client, and the existing Cloudflare Access application audiences remain unchanged.
Identity continuity
Both products currently bind assignments to a normalized, verified email claim. The Authentik account must therefore emit the same verified email already assigned in House Desk, Pub, and any exact-email Access policy. Changing that claim is an account migration, not a cosmetic profile edit.
Onboarding and revocation
- Create or verify the staff identity in Authentik.
- Admit the identity through the existing product’s Cloudflare Access policy.
- Assign the minimum product-local role or permission snapshot.
- Test an allowed action and a deliberately denied action.
- On departure, revoke the product assignment and edge admission; disable the shared identity when no service still needs it.
The sign-in directory can become shared without merging authorization. This keeps an outage or policy mistake in one product from silently expanding access in another.
Recovery during home hosting
The initial Authentik server is home-hosted and published through Cloudflare Tunnel. A bounded Cloudflare One-time PIN or equivalent steward-only recovery login should remain available until the identity service has redundant hosting and a tested restore path. Recovery identities remain separately constrained by each product’s local authorization.
Do not put the Authentik hostname behind a Cloudflare Access policy that itself requires Authentik; that would create a circular login dependency.
Retired direction
House Systems IAM and control-plane development are discontinued. Authentik replaces the intended shared identity function. Any remaining House Systems status snapshot endpoint is a separate compatibility or retirement concern and is not an authorization dependency.