Who is this identity?
Customers, employees and administrators can have distinct profiles, lifecycle rules, authenticators and dashboard access. Tenant roles add another layer of scoped administration.
Inspect identity boundaries →A practical evaluation, not a slogan
Connect the identity decision to the work, the policy and the evidence.
For B2B SaaS teams, identity is more than sign-in. WebFrolic is designed to connect tenant administration, customer and workforce identities, service identities, access workflows and support operations—while allowing each identity class to follow distinct rules.
The product model
Five connected questions. One place to examine them.
Rather than leading with an exhaustive feature list, start with the problems that create operational and security gaps when handled separately.
Which policy applies now?
Authenticator assurance, network filters, session controls and rate limits can be configured at different levels rather than treating every identity and operation the same.
Inspect policy controls →What happened—and why?
Audit records are built into the architecture, with user, session and device context. Session and API-key visibility also gives people a way to review and revoke access.
Inspect the evidence model →Evaluate the difference
Compare the design against the problem you need to solve.
This matrix describes WebFrolic's documented approach and the questions to test during an evaluation. It is not a vendor-by-vendor feature ranking; products change, and details should be verified directly.
| Your challenge | WebFrolic's documented approach | What to ask us to demonstrate |
|---|---|---|
| Customer and employee access overlap | Distinct customer, employee and administrator classifications, with segment-specific profile attributes, authenticators, applications, groups, roles, network rules and session controls. | Show how policies differ for the same type of person in customer and employee contexts, and how classification changes are managed. |
| Tenant administration must be scoped | Tenant-level roles can govern tenant members, groups and integration settings, including SAML/OAuth2 authenticators, SCIM, domains and tenant network or assurance rules. | Show where a tenant administrator's permissions start and stop, and how an enterprise tenant is configured. |
| Identity flows can be chained | Signup, enrollment and verification have separate preconditions; explicit recovery credentials and server-side extended state define valid transitions. | Attempt an invalid transition. Inspect what the server remembers and how the recovery path differs from ordinary enrollment. |
| Support access is too powerful | Support staff can assist by enrolling a recovery credential rather than directly replacing existing authentication credentials. Recovery safeguards can include assurance requirements, account lock periods and API-key revocation. | Walk through support-assisted recovery, owner communications, credential handling and the post-recovery state. |
| Shared accounts blur accountability | Service users and machine identities provide explicit models for privileged/service access and OAuth2 client-credentials use cases. | Show how a service identity receives roles or resource access, how it is used, and how actions are attributed. |
| Access and support live in separate processes | Employee workflows include resource access requests, review/approval, resource catalogue and IT service desk. Support and service desks have separately scoped responsibilities. | Show one access request or support ticket from creation through routing, decision and audit record. |
The right choice depends on your threat model, deployment needs, required integrations and operational constraints. Treat each row as an evaluation question, not as proof that WebFrolic is best for every environment.
A practical wedge for B2B platforms
Give tenants room to operate—without losing the platform boundary.
For multi-tenant products, identity has to separate the platform administrator's authority from what each business customer can manage for its own people.
Tenant administrator
Controls for the customer's own boundary
Depending on assigned role access, tenant administrators can manage members, configure SCIM, manage tenant SAML/OAuth2 settings, maintain tenant groups and domains, configure tenant network filters and assurance requirements, and assign scoped roles to other members.
Read the B2B product guide →Platform administrator
Controls for the identity system itself
Platform administrators manage identity-provider resources. The product documents separate administrator, employee and customer dashboards, with classification rules evaluated on dashboard paths.
Explore console documentation →Security controls to inspect
Controls are most useful when they compose.
WebFrolic makes several controls configurable at different boundaries. During technical evaluation, ask to see how they interact in your intended identity flow—not only how each setting looks in isolation.
01 / STATE
Server-side flow state
The state includes past steps, the current step, possible next steps and validation for transitions. Identity flows are modeled as transactions with recorded relationships and order.
Read the security paper ↗02 / POLICY
Layered rate and network rules
Rate limits can operate by user, session, tenant, IP address and operation. Network allow/deny rules can apply to identity categories, roles, tenants, integrations, applications, service accounts and API keys.
Review product surfaces ↗03 / RECOVERY
Recovery has its own safeguards
Recovery assurance requirements can be configured by identity classification. Other options include deleting authentication credentials, temporarily locking the account and revoking the user's API keys after recovery.
Understand the principles ↗Evidence for evaluators
Start with what your team can verify.
Strong evaluation means reproducing critical behavior with your own scenarios. Use the existing product material to form specific questions, then walk through the implementation with the WebFrolic team.
Read the operating model
Map the personas, tenant boundaries, dashboards and common workflows to your own product and support organization.
Product guide →Inspect the interfaces
Look at the documented user, tenant, group, SCIM, application, session, secret and variable operations before committing to an integration plan.
API reference →Test a critical flow
Bring one high-value scenario: an employee changing role, a tenant administrator configuring SSO, or a support-assisted recovery. Ask to see both the decision and its record.
Plan an evaluation ↗We do not publish customer logos, conversion uplift, performance benchmarks or third-party certification claims here without evidence. Ask for the evidence relevant to your evaluation and deployment requirements.
Questions worth asking
Be specific. Security evaluation should be.
Does a unified platform automatically mean fewer risks?
No. Consolidation can reduce integration seams, but security still depends on configuration, implementation, operational access and how the system is deployed. Evaluate controls and test the paths that matter to you.
Can WebFrolic replace every identity tool we have?
That depends on your requirements. Compare the documented capabilities with your protocols, regions, deployment model, governance obligations, integrations and migration constraints. A walkthrough should identify gaps as well as fit.
How do we check the security claims?
Use the security white paper as a design explanation, then validate behavior with a technical walkthrough. Ask about operational controls, incident response, independent testing, certifications, data handling and availability commitments as separate evidence questions.
Make your evaluation concrete
Start with one hard workflow.
Tell us the identity problem, the systems involved and the behavior you need to prove. We can use that scenario to focus a technical conversation around policy, integration, recovery and auditability.