Delegate access across a portfolio
Assign organization-scoped roles and keep agency access separate between customer tenants.
Expected result
Operators see only explicitly delegated organizations and services.
Delegation model
An agency workspace is a portfolio view, not a shared customer tenant. Policies, evidence and credentials stay attached to the customer organization.
Use analyst access for investigation and separate approver access for disruptive changes.
Verification
- Invited user sees only delegated tenants
- Sensitive actions remain approval-gated