Summary: Barndoor, an AI gateway that governs MCP servers and models, connects to Okta and Entra via SAML or OIDC and uses your existing users, roles, and groups to scope what each person and AI agent can do.
Barndoor connects to Okta or Entra via SAML or OIDC, bringing your existing users, roles, and groups in without rebuilding them. You then scope what each person can do when using AI: least privilege for how humans use AI, not just whether they can log in.
Barndoor can apply access policies at the group, team, role, and user level defined in your identity provider. With the integration you can govern which MCP servers and tools each person, team, or AI agent can use, which LLM models teams and agents can use, and spend limits and token budgets.
AI agents get their own identity. Every agent gets its own AgentProfile with its own credentials and a human sponsor, scoped to the tools, models, and data its job requires.
Setup needs an admin from your identity provider on a short setup call with a Barndoor engineer to create a connected app and exchange a client ID and secret. That exchange, plus a callback URL and the right scopes, lets Barndoor authenticate through your identity provider. You can revoke AI access directly in Barndoor without touching your identity provider's configuration.