Decide whether Straza fits

The pages an IAM or security architect reads, in order, to decide whether to run a pilot.

On this page

How it works describes the model that the later pages build on.

1. What Straza isConceptWhat Straza does, who it is for, and what it does not try to do.
2. How it worksConceptA diagram of every core noun, and a tool call traced on the agent’s machine and at the gateway.
3. The security modelSecurityWhat Straza enforces and where. An action that bypasses the hook, the gateway and straza exec is outside Straza’s view.
4. Known limitsSecurityA table of the known limits that matter for a fleet. If you manage Claude Code through a device management profile, server-managed settings or a Windows registry policy, read the row on its managed sources first. Claude Code uses only its highest managed source, so if any of those lacks Straza’s hooks, Claude Code skips the hooks and gives no warning.
5. Identity and your IGAConceptYour identity provider checks sign-in, and your IGA, or an admin on standalone, owns people, agents and who holds which role. Straza owns what each role may do.
6. ObjectsConceptHow a role covers some of a server’s objects, and what a certifier reads in your IGA.
7. Try it on the demo stackTutorialRun midPoint, Keycloak and working agents on one machine, and check your pilot’s questions against them.
8. Plan your deploymentReferenceThe standalone and enterprise profiles compared, with the setting behind each difference. Read it once you decide that Straza fits.

NextSet up Straza for a team→