Mistral Enterprise Access Governance

Overview

Separate provider administration from application authorization. Provider controls govern resources/capacity; the application still enforces users, tenants, data, and tools.

Prerequisites

• An identity source, joiner/mover/leaver process, and access owner.
• Organization/workspace inventory, role catalog, service identities, and break-glass policy.
• Current roles, service-account, workload-identity, and audit evidence.

Current Contract

Mistral documents workspaces, groups, roles, service accounts, workload identity, keys, and audit logs. Exact entitlements and plan access come from current admin evidence.

Authentication

Prefer approved non-human service identities. API keys authenticate provider calls but never substitute for application user identity or tenant authorization.