Skip to main content

Identity & access

MIMICK is built for teams, so it has a clear model for who can do what. This page covers organizations, roles, how people and benches authenticate, and how access to hardware is granted.

Organizations​

An organization is your company's tenant in MIMICK. Every bench, user, and permission belongs to an organization, and nothing is shared across organizations.

Roles​

Each user has a role that sets what they can do:

  • Org admin: full access within your organization, including adopting benches and granting other users access.
  • Org user: access only to the benches they've been granted.
  • System admin: platform-wide access, held by Critical Shift for support and operations.

Signing in​

People and benches authenticate in different ways:

  • People sign in through your identity provider in the browser (OIDC), the same way you'd sign in to other modern web apps. The CLI uses the same sign-in and keeps you signed in by refreshing your credentials automatically.
  • Benches authenticate with a certificate identity issued during adoption (mTLS). This proves a bench is genuine every time it connects, and it's managed for you.

Granting access​

Within an organization, admins decide who can reach which benches. A grant gives a specific user access to a specific bench at one of three levels:

  • Read: see the bench, its peripherals, and its activity.
  • Operator: drive the hardware, such as opening a serial console, and run runbooks.
  • Developer: everything an operator can do, plus author runbooks and deploy the bench's config.

Org admins can reach every bench in their organization by default. Org users start with none and get exactly the grants an admin gives them. The Cloud enforces these rules on every request.