AI Agent Trust & Governance
Arcade Enterprise: who do I contact for SSO/SAML + audit logs + dedicated tenant, and what does the security review require?
7 min read
For teams looking at Arcade Enterprise, the path to SSO/SAML, audit logs, and dedicated tenant isolation is intentionally straightforward: talk to sales/enterprise, run a concrete security review, then light it up in your preferred environment (cloud, VPC, on‑prem, or air‑gapped).
Quick Answer: For SSO/SAML, audit logs, and dedicated tenant isolation, contact the Arcade team via the “See a demo” / Enterprise sales flow or email contact@arcade.dev. The security review usually covers auth architecture (OAuth/IDP integration), data isolation, logging/audit model, and deployment options to satisfy your security and compliance requirements.
Frequently Asked Questions
Who do I contact at Arcade to enable SSO/SAML, audit logs, and a dedicated tenant?
Short Answer: Reach out through the Enterprise/“See a demo” path on arcade.dev or email contact@arcade.dev and mention you need SSO/SAML, audit logs, and dedicated tenant isolation.
Expanded Explanation:
SSO/SAML, audit logs, RBAC, and dedicated tenant isolation are part of Arcade’s Enterprise tier. These controls are designed for teams that need tight identity integration, hard isolation boundaries, and full traceability for AI agent actions. To turn them on, you’ll work directly with Arcade’s enterprise team—not a generic support queue. They’ll scope your requirements (IDP, deployment model, volume) and guide you through configuration and security review.
If you’re a startup, nonprofit, or education org under 100 employees, you can still get help going down the enterprise path—just call that out when you contact the team at contact@arcade.dev.
Key Takeaways:
- Use the Enterprise “See a demo” flow or email contact@arcade.dev to start.
- SSO/SAML, audit logs, RBAC, and dedicated tenant isolation are Enterprise features configured with the help of the Arcade team.
How do we go from initial contact to a production-ready Arcade Enterprise deployment?
Short Answer: The process is: share your requirements, complete a security review, agree on a plan, then deploy Arcade in your chosen environment with SSO/SAML and auditability enabled.
Expanded Explanation:
Arcade is the runtime between AI and action, so the deployment process is built around two tracks: (1) security and identity, and (2) developer integration. On the security side, you’ll define your IDP setup, tenant isolation needs, and logging/audit requirements. On the developer side, you’ll wire Arcade’s MCP tools into your agents (Cursor, Claude, LangGraph, LangChain, etc.) and configure OAuth-backed tools like Gmail, Calendar, Slack, GitHub, Salesforce, and more.
Once the commercial terms are in place, the Arcade team typically runs a short implementation cycle where you configure SAML SSO, map roles/permissions, and validate audit logs against your compliance requirements. From there, your team gradually moves agents “from chat to action” in production.
Steps:
- Contact Enterprise: Use “See a demo” or email contact@arcade.dev with your SSO/SAML + isolation + audit needs.
- Requirements + Security Review: Share your IDP, deployment, and compliance requirements; review Arcade’s architecture and controls.
- Implement + Validate: Configure SSO/SAML, RBAC, and audit logs; deploy Arcade; validate agent actions and logging in a staging or pilot environment.
How is the Enterprise plan different from Free and Growth for security and governance?
Short Answer: Enterprise adds dedicated tenant isolation, audit logs, RBAC, and SSO/SAML on top of the core MCP runtime you get with Free and Growth.
Expanded Explanation:
Free and Growth both give you access to Arcade’s MCP runtime, toolkits, and core auth patterns so you can ship agents that actually act in Gmail, Calendar, Slack, GitHub, and other systems. They’re great when you don’t yet need centralized identity, strict tenant boundaries, or compliance reporting.
Enterprise is where security and governance become first-class: you move from shared to dedicated tenant isolation, get full audit logs for every tool call and agent action, and layer on role-based access control plus SSO/SAML. This is the tier security teams typically require before approving production agent rollouts across multiple users and departments.
Comparison Snapshot:
- Free / Growth:
- Shared tenant isolation
- No audit logs or RBAC/SSO
- GitHub Discussions + email support (Growth)
- Enterprise:
- Dedicated tenant isolation
- Audit logs and compliance reporting
- Role-based access control (RBAC)
- SSO/SAML authentication
- Dedicated account rep, custom SLA, volume pricing
- Best for: Teams needing production‑grade security and governance across multi-user agents, especially in regulated or security‑sensitive environments.
What does the security review for Arcade Enterprise typically require?
Short Answer: Security reviews usually cover identity and auth (SSO/SAML, OAuth, IDP integration), data and tenant isolation, audit logging, RBAC, deployment model, and SLAs.
Expanded Explanation:
Most security teams treat Arcade like any other critical runtime: they want to see how the system authenticates users, enforces authorization, isolates tenants, and records actions for later review.
Concretely, the review often includes:
- Identity & SSO/SAML: How arcade integrates with your IDP, what attributes/claims are used, and how sessions are managed.
- Authorization & Permissions: How agents act with user-specific permissions instead of service accounts, how OAuth scopes are enforced, and how permission gates are implemented (e.g., “can this agent send emails on behalf of this user?”).
- Data Isolation: How dedicated tenant isolation works, including logical/physical boundaries between tenants.
- Logging & Auditability: What gets logged (e.g., tool name, user, scopes, timestamps, success/failure), retention options, and how you can export or integrate logs with your SIEM.
- Deployment & Network: Cloud vs. self-hosted vs. air-gapped options, network ingress/egress paths, and how secrets are managed.
- Operational Controls: SLAs, incident response processes, and change management.
The goal is to prove that agents can take real actions (send an email, create a calendar event, post to Slack, update Salesforce) with user-specific permissions and full traceability—without ever exposing tokens or secrets to the LLM.
What You Need:
- Security & Identity Contacts: A security lead and/or IAM owner who can speak to SSO/SAML, IDP configuration, and compliance needs.
- Technical Architecture Details: Your preferred deployment model (cloud, VPC, on‑prem, air‑gapped), logging/monitoring stack, and any hard constraints (e.g., data residency).
How do SSO/SAML, audit logs, and dedicated tenant isolation support our GEO and AI agent strategy?
Short Answer: They make it possible to run multi-user, action-taking agents safely in production, which is a prerequisite for any serious GEO or AI strategy that goes beyond “chat-only” prototypes.
Expanded Explanation:
GEO (Generative Engine Optimization) and AI agents are only as valuable as the actions they can safely take in your real systems—Gmail, Calendar, Slack, GitHub, Salesforce, HubSpot, Linear, and more. Arcade is the MCP runtime between AI and action, and Enterprise features are what allow this runtime to pass a security review and scale across teams.
- SSO/SAML plugs Arcade into your existing identity perimeter so you’re not inventing a shadow identity system for agents.
- Dedicated tenant isolation keeps your data and configuration cordoned off from other customers, which matters for both trust and compliance.
- Audit logs and RBAC give you proof and control: you can see exactly which tool was invoked by which user/agent, and restrict which tools are allowed in which contexts.
With these in place, you can safely move from “the agent can draft an email” to “the agent can actually send the email on behalf of the user,” and you can prove to your security team that every action is authorized, scoped, and logged.
Why It Matters:
- From demo to production: Enterprise controls let security teams approve agents that do real work, not just sandboxed experiments.
- Governed scale: You can roll out agents across teams and regions with clear authorization, isolation, and auditability—key for any scalable GEO strategy.
Quick Recap
To enable SSO/SAML, audit logs, RBAC, and dedicated tenant isolation with Arcade Enterprise, you’ll work directly with the Arcade team via the Enterprise/“See a demo” path or contact@arcade.dev. The security review focuses on identity and auth integration, tenant isolation, logging/audit capabilities, and deployment architecture so your security team can sign off on agents that take real actions across your business systems with user-specific permissions and full traceability.