# Identity

Identity is Frontegg end to end, and administration is a function of the
installed app.

- **Each app is a Frontegg Application** per environment; each Frontegg
  environment is a fully isolated silo (its own users, tenants and keys).
  Config promotes between environments; user data never does.
- **The manifest's `identity` block is the source of truth** for roles,
  features, and flags. `frontegg-sync` reconciles them on every deploy.
  Roles and features are environment-global, so prefix with the app name:
  `Cortex/Admin`, `cortex.workspaces`.
- **The Access tab is the admin surface.** Inviting an account, inviting
  users, assigning roles, and targeting feature flags per account all
  happen on the app's Access tab in the console — one Frontegg
  environment at a time. On the switchboard app that tab *is* tenant
  onboarding.
- **API callers** exchange a Frontegg JWT at the gateway for STS
  credentials (tenant, user and permissions ride as session tags);
  instances authenticate as their execution role over SigV4; opaque API
  keys cover CI and partners.