---
title: "Overview"
description: "The walt.id Enterprise Stack provides fine-grained access control using Role-Based Access Control (RBAC) with optional integration into external Identity and Access Management (IAM) systems."
stack: "Enterprise Stack (commercial) — version 0.21.0"
stack_version: "0.21.0"
stack_comparison: https://docs.walt.id/community-vs-enterprise.md
canonical_url: https://docs.walt.id/enterprise-stack/administration/access-and-permissions/overview
generated: 2026-07-08
---
# Overview

The walt.id **Enterprise Stack** provides fine-grained access control using **Role-Based Access Control (RBAC)** with optional integration into external **Identity and Access Management (IAM)** systems.

This model clearly separates:

- **Authentication**: Who a caller is
- **Authorization**: What a caller is allowed to do

## Authentication Methods

Authentication can be performed using:

| Method | Use Case |
|--------|----------|
| Local Accounts | Email/password authentication for users |
| API Keys | Machine-to-machine authentication |
| External IAM (OIDC) | Integration with enterprise identity providers |

## Authorization Model

Authorization is enforced by the Enterprise Stack using RBAC.
1. Request arrives with authentication token 
2. Resolve identity (account, API key, or OIDC user) 
3. Load assigned roles and their permissions 
4. Check allow rules: Does user have required permission? 

## Two-Layer Enforcement

The Enterprise Stack enforces permissions at two layers:

1. **Route-Level Authorization**: Each API endpoint requires specific permissions. Requests without the required permission receive `403 Forbidden`.

2. **Persistence-Level Authorization**: Database operations are filtered based on user permissions, ensuring users can only access resources they're authorized to see.

This dual-layer approach provides defense in depth, ensuring comprehensive security.

## Resource Hierarchy

Resources in the Enterprise Stack follow a hierarchical structure:

```
Organization
    │
    ├── Tenant A
    │   ├── Issuer Service
    │   ├── Verifier Service
    │   └── KMS Service
    │
    └── Tenant B
        └── Wallet Service
```

Permissions propagate **top-down**:
- A permission granted at the organization level applies to all tenants and services
- A permission granted at the tenant level applies to all services within that tenant

## Security Best Practices

For production deployments:

| Practice | Description |
|----------|-------------|
| Use External IAM | Integrate with your enterprise identity provider (OIDC) for workforce authentication |
| Least Privilege | Grant only the permissions necessary for each role |
| Narrow Scopes | Assign permissions at the narrowest scope needed |
| Rotate API Keys | Establish regular rotation schedules for API keys |
| Short-Lived Tokens | Use short-lived access tokens where possible |
| Avoid Super Admin | Use Super Admin only for initial setup, not for day-to-day operations |
| Monitor Audit Logs | Review logs for privileged operations and anomalies |
| Use Deny Rules | Apply deny rules to create exceptions for sensitive operations |

## Learn More

### Core Concepts
- [RBAC Model](https://docs.walt.id/enterprise-stack/administration/access-and-permissions/rbac-model.md) - Understand roles, permissions, and evaluation logic
- [Permissions](https://docs.walt.id/enterprise-stack/administration/access-and-permissions/permissions/overview.md) - Complete reference of all available permissions

### Managing Access
- [Roles](https://docs.walt.id/enterprise-stack/administration/access-and-permissions/roles/overview.md) - Create and manage role definitions
- [Accounts](https://docs.walt.id/enterprise-stack/administration/access-and-permissions/accounts/overview.md) - Manage local user accounts
- [API Keys](https://docs.walt.id/enterprise-stack/administration/access-and-permissions/api-keys/overview.md) - Create keys for machine-to-machine access
- [Super Admin](https://docs.walt.id/enterprise-stack/administration/access-and-permissions/super-admin/overview.md) - Unrestricted administrative access

### Integration
- [IAM Integration](https://docs.walt.id/enterprise-stack/administration/access-and-permissions/iam-integration.md) - Connect to external identity providers via OIDC
- [External Role Mapping](https://docs.walt.id/enterprise-stack/administration/access-and-permissions/external-role-mapping.md) - Automatically assign permissions based on IdP roles
- [Permissions](https://docs.walt.id/enterprise-stack/administration/access-and-permissions/permissions/overview.md) - Discover available permissions and their scope
- [Roles](https://docs.walt.id/enterprise-stack/administration/access-and-permissions/roles/overview.md) - Define and manage user roles and their permission sets
- [Accounts](https://docs.walt.id/enterprise-stack/administration/access-and-permissions/accounts/overview.md) - Manage local user accounts and authentication
- [API Keys](https://docs.walt.id/enterprise-stack/administration/access-and-permissions/api-keys/overview.md) - Create and manage API keys for machine-to-machine access
- [Super Admin](https://docs.walt.id/enterprise-stack/administration/access-and-permissions/super-admin/overview.md) - Grant unrestricted administrative access with caution