About AuthHub
AuthHub is an Enterprise AI Governance and Fine-Grained Authorization platform. Built on Google Zanzibar-inspired ReBAC models and AuthZEN standards, it extends beyond static access control into dynamic, AI-aware governance — enforcing business rules, budget constraints, and compliance requirements at the authorization boundary in real-time.
Our Beyond Zero layer brings AI-native authorization: risk-adaptive decisions, intent verification, anomaly detection, and challenge-based authentication — all evaluated in under 3ms. Combined with our AI Governance Signal Integration, AuthHub becomes the policy enforcement point where business reality meets technical access.
Our Heritage: Deep Enterprise IAM Roots
The AuthHub team's DNA is rooted in high-level identity security, having operated as a specialized consultancy dedicated to delivering state-of-the-art IAM solutions to enterprises across Europe, the Middle East, and Africa (EMEA).
As specialist consultancy in the EMEA region, our founders brought over 20 years of combined Identity and Access Management experience to the table.
- We have successfully executed and guided various very large-scale and complex national and international IAM engagements.
- We intimately understand the political and organizational challenges that are inherent to most large security and IAM projects.
- We know that a successful project requires not just outstanding technical expertise, but effective governance, robust executive sponsorship, and organizational discipline.
Our Architectural Philosophy
We approach Fine-Grained Authorization with a battle-tested perspective on system design. Our core technical philosophies have remained consistent throughout our evolution:
“A successful architecture must be elegant, scalable, and adaptable enough to respond to evolving business and regulatory demands.”
- Our architectural philosophy heavily emphasizes simplicity and elegance.
- We are firm proponents of loosely coupled architectures that promote agility by embracing open standards and minimal customization.
- We recognize that highly customized and over-engineered security solutions have a tendency to become unmanageable over time.
- We understand that business processes and organizational needs are extremely fluid, demanding infrastructure that scales cleanly.
Proven Industry Expertise
Our unique set of best practices and implementation guidelines is backed by vast experience delivering complex enterprise solutions across a wide range of industry verticals. We have secured identities and built infrastructure for:
NIST Security Framework Alignment
AuthHub's architecture is designed against the latest NIST security standards. Independent assessment confirms strong alignment with NIST CSF 2.0, NIST SP 800-207 (Zero Trust), and the NIST AI Risk Management Framework.
Zero Trust Architecture (NIST SP 800-207)
NIST mandates dynamic, continuously-evaluated access decisions. AuthHub implements a Three-Clock Governance Pattern that eliminates temporal drift:
- ✓ Event-time triggers — structural changes detected and access suspended in <500ms
- ✓ Attestation-time signatures — dual-gate re-attestation with environmental condition tracking
- ✓ Execution-time admissibility boundary — inline staleness and drift checks on every evaluation
- ✓ Consistency tokens — Zanzibar-style Zeta tokens prevent the "New Enemy Problem"
- ✓ Namespace micro-segmentation — cryptographically-scoped boundaries prevent lateral access
AI Risk Management (NIST AI RMF & IR 8596)
AuthHub's AI-powered import pipeline implements NIST-recommended guardrails for generative AI systems:
- ✓ Prompt injection defence — strict Zod schema validation on inputs + structured JSON output enforcement
- ✓ Human-in-the-loop — mandatory UI confirmation before AI-mapped data is committed to the authorization graph
- ✓ PII egress filtering — DataScrubber middleware sanitises NHS numbers, emails, and structured identifiers before external API dispatch
- ✓ AI agent governance — registered agents with scope bounds, rate limits, and delegated authorization via SpiceDB caveats
Cybersecurity Framework 2.0 (NIST CSF 2.0)
AuthHub maps to all five CSF core functions:
| Function | AuthHub Implementation |
|---|---|
| Govern (GV) | Tenant-configurable governance policies, attestation workflows, environmental drift declarations |
| Identify (ID) | SCIM 2.0 identity lifecycle, AI agent registry, namespace-scoped asset inventory |
| Protect (PR) | ReBAC/FGA with SpiceDB, mTLS, namespace isolation, HSM-backed keys, rate limiting |
| Detect (DE) | Real-time audit streaming via Kafka, AI anomaly detection (Log Sentinel), Prometheus alerting |
| Respond (RS) | Break-glass (AARP), automatic suspension on structural changes, admissibility boundary denials |
Standards & Interoperability
AuthHub implements open standards for enterprise interoperability — validated by the OpenID Foundation conformance suite:
- ✓ OpenID AuthZEN 1.0 — standards-based policy evaluation with SARC model (120+ conformance tests passed)
- ✓ SSF / CAEP 1.0 — Shared Signals Framework for real-time security event streaming (conformance tested)
- ✓ OpenID Connect Core 1.0 — Authorization Code Flow with discovery, PKCE, and key rotation
- ✓ OAuth 2.0 DPoP (RFC 9449) — Sender-constrained tokens resistant to theft and replay
- ✓ XAA / Cross-App Access (ID-JAG) — Enterprise IdP-mediated agent-to-app access without per-user consent
- ✓ Workload Identity Federation (RFC 8693) — Zero-trust token exchange for CI/CD and cloud workloads
- ✓ SCIM 2.0 — full identity provisioning with 18+ IdP support
- ✓ Google Zanzibar — proven ReBAC architecture via SpiceDB
- ✓ NHS CIS2 — Care Identity Service 2 federation for NHS Smartcard authentication
- ✓ NHS DSPT — Data Security and Protection Toolkit compliant (7-year immutable audit)
- ✓ UK GDPR — Right to erasure, data minimisation, processor agreements
- ✓ ISO 27001 / SOC 2 — available on Critical Infrastructure tier
Beyond Zero: AI-Native Dynamic Authorization
Traditional authorization answers “does this user have permission?” Beyond Zero answers a harder question: “given everything we know about this user, this request, and this moment — should we allow it?”
Fast Path (<3ms)
Risk evaluation, intent alignment, and staleness checks — all within a 3ms budget. Zero perceptible latency.
Challenges
Graduated friction instead of binary deny. Legitimate users pass quickly; attackers face escalating barriers.
Containment
Automated blast-radius limitation. L1 rate-limits → L2 scope restricts → L3 suspends → L4 break-glass.
Decision DAG
GDPR Article 22 compliant. Every automated decision produces a human-readable explanation graph.
Intent Tokenisation
Natural language intent parsed into scope tags. Access scoped to declared purpose, not standing permissions.
Common-Exposure Governance
Shared conditions (model providers, data processors) tracked as first-class versioned entities with two-tier drift response.
The Bridge Between Security Governance and Business Governance
Security teams control who can access what. Business teams control whether that access still makes commercial sense. These two worlds have always operated in silos — until now.
AuthHub's Governance Signal Integration is the enforcement bridge that makes business decisions technically real in under 2 seconds. When a budget is exceeded, a contract expires, or a vendor becomes non-compliant, AuthHub enforces that decision at the authorization boundary — instantly, automatically, and with full audit trail.
AuthHub doesn't replace either governance function. It's the point where business decisions become technically enforceable — without building custom integrations or relying on manual processes.
Explore the full Governance Bridge capabilities →
Real-Time Budget Enforcement: FinOps signals throttle or suspend AI spend when thresholds are breached. No more month-end bill shock.
Contract Lifecycle Enforcement: Vendor contract expiry or non-compliance instantly revokes affected AI agent access. No orphaned permissions.
Decision Owner Attestation: Secure one-click approvals pushed to Slack/Teams. Named humans accountable — not IT intermediaries.
Emergency Break-Glass: Dual-approval time-bounded overrides with full audit trail and auto-expiry. Business continuity without security compromise.
Intelligent Model Downgrade: Route from expensive frontier models to cost-effective alternatives — without blocking users or killing productivity.
Active Stream Termination: Kill runaway AI token streams mid-flight via gateway dispatch. Stop the bleed in milliseconds.
Open Standards Contributions
AuthHub contributes to the open standards ecosystem for AI governance interoperability:
Open Agent Governance Protocol (OAGP) — Draft v1.0
A standardized framework for propagating governance context, communicating enforcement decisions, and facilitating remediation across heterogeneous AI agent systems.
Read the specification →Our Core Values
At AuthHub, we take pride in building strategic, long-term relationships with our customers, partners, and employees. Everything we build is driven by five core values:
| Value | Our Commitment |
|---|---|
| Quality | Delivering excellent standards consistently and high stability. |
| Collaboration | Working closely with you at all stages as a team and trusted advisor to meet business objectives. |
| Commitment | Maintaining an open and honest engagement, emphasizing best efforts to meet timescales and high standards. |
| Innovation | Constantly seeking out new technologies, tools, and products to maintain industry-leading technical capabilities. |
| Assurance | Providing the deep competence and knowledge that can only be gained from extensive enterprise project experience. |
Ready to get started?
Join organisations already securing their applications with AuthHub.