Phase 1 — Now Building

The governance layer between auth and your app

ContextIO is neutral middleware that consumes identity tokens from any provider, enforces consent and authorization, normalizes context, and passes a clean envelope to your application logic.

Request Early Access →

What it enforces

Five capabilities. One middleware.

🔑

Identity Resolution

Consumes OIDC/OAuth2 tokens from any provider. Resolves actor, principal identifiers, session, and risk signals without storing credentials.

🛡️

Authorization (RBAC + ABAC)

Deterministic rule evaluation with role-based baseline and attribute-based context decisions. Policy versioned, every decision logged.

✋

Consent Enforcement

Purpose-based, versioned consent grants evaluated at ingestion and execution. Immediate revocation propagation across all downstream systems.

📦

Context Normalization

Stable canonical envelope schema: actor, entitlements, consent state, locale, channel, device. Namespaced extensions for any domain.

📋

Audit Logging

Every consent change, rule execution, adapter invocation, and token evaluation logged with trace IDs. Tenant-isolated, role-based admin controls.

🔌

Pluggable Adapters

Commerce, inventory, identity, analytics, messaging. Independently versioned, tenant-scoped, with circuit breakers and consent-flag enforcement.

Sharp boundaries.

ContextIO is

✓ SSO-agnostic governance middleware

✓ Stateless, horizontally scalable

✓ Event-driven with replayable logs

✓ Tenant-isolated by design

✓ SOC 2 trajectory from day one

ContextIO is not

× An identity provider

× A payment processor

× Cross-tenant data aggregation

× Autonomous AI action execution

× Identity resale or brokerage

Canonical Context Envelope

                
                
                
                context-envelope.json
            

{
  "actor": {
    "type": "user",
    "principalId": "usr_a1b2c3",
    "provider": "okta"
  },
  "entitlements": ["inventory.read", "orders.write"],
  "consent": {
    "purpose": "order_fulfillment",
    "version": "2.1",
    "granted": true
  },
  "context": {
    "locale": "en-US",
    "channel": "web",
    "riskScore": 0.12
  },
  "policy": {
    "id": "pol_commerce_v3",
    "version": "3.0.1"
  },
  "traceId": "trc_9f8e7d6c"
}
            