Aegis / Frostbyte AI - Product Feedback

Hey Sofia, yeah, appreciate you jumping on. Okay so — where do I start. So we've been on Aegis Identity now for, I want to say, about seven months? Maybe closer to eight.

It was, yeah, we had a couple of back-and-forths with your support team on that, but it got resolved. So no complaints there. The reason I wanted to have this call is really around some gaps we're hitting on the IAM side — specifically around how Aegis Identity handles role management at scale.

Okay, yeah, tell me more. What does scale look like for Frostbyte right now in terms of, like, users and roles?

So we're sitting at roughly — and this has grown a lot this year — we're at about 1,400 users across the organization. And the role taxonomy is... it's gotten complicated. We've got engineering, ML infrastructure, data, product, and then all the corporate functions on top of that.

And the issue we keep running into is that there's no good way to do nested role inheritance within Aegis Identity. Like, I can define roles, I can assign permissions, but I can't say — this team lead role inherits everything from the senior engineer role, plus these additional permissions. It's all flat.

Yeah, that's — that's a known limitation in the current version, I'll be straight with you. The role model right now is flat, there's no hierarchical inheritance baked in. It's something that's been on the roadmap for a while.

So it is on the roadmap? Do you have any sense of timeline?

Not a GA date, no. The last I heard from our product team, hierarchical roles is in active development, but I haven't seen a committed date for release. I can definitely follow up with our product management contact and get you something more specific, Victor.

Yeah, that would be helpful. Because right now what we're doing is — we're basically duplicating permissions manually across roles, which is, uh, it's error-prone and it's a pain to audit.

Yeah, I get that. That's exactly the kind of thing hierarchical inheritance would fix. Can I ask — when you say it's hard to audit, are you running into issues specifically around access reviews, or is it more the day-to-day management overhead?

Honestly both, but the access review piece is becoming more urgent. We're going through a SOC 2 audit right now — we're actually using Aegis Comply for some of that, which, by the way, the v2 stuff that came out earlier this month is pretty solid.

+1Victor calls Aegis Comply v2 pretty solid. · product capability

Oh good, yeah the on-demand reporting in Comply v2 — I was hoping that would land well for your team.

Yeah the on-demand SOC 2 report generation is saving us real time. But — the issue is that when the auditors start pulling on the thread of who has access to what and why, the role structure in Identity doesn't tell a clean story because everything is kind of manually duplicated.

+1Victor says on-demand SOC 2 report generation is saving real time. · compliance reporting

That makes sense. So there's almost a compounding problem where the flat role structure creates noise in your compliance reporting even if the underlying access is technically correct.

Agreed, yeah. Victor, is there anything else on the Identity side beyond the role hierarchy piece, or is that the main one?

There's — yeah there's one other thing. It's maybe a smaller ask, but it's been bugging us. The session timeout policies — right now it seems like you can only set one global timeout, right? There's no way to do it per role or per resource.

That's correct, yeah. One global session timeout config right now.

So what we'd really want is to say — okay, for users accessing our ML training infrastructure, we want a shorter timeout, maybe 30 minutes, because those environments are sensitive. But for, like, someone just accessing our internal wiki through SSO, a four-hour timeout is totally fine. We shouldn't have to apply the most restrictive policy globally.

Yeah, that's a reasonable ask. Role-based or resource-based session policies. I don't believe that's on the short-term roadmap but — honestly, Victor, I'm going to be honest, I'd have to check. I don't want to guess.

Yeah, and I'll make sure both of these — the hierarchical roles and the session policy granularity — are written up formally and submitted to product. And I'll loop in your CSM so there's visibility on our end into how this gets prioritized.

Great. And — look, I want to be clear, I'm not raising this because I'm about to go evaluate alternatives or anything like that. It's more that — we're growing fast, and I want to make sure Aegis Identity can grow with us. If these things get addressed in the next couple of quarters, we're in good shape.

It's fair feedback and I'll pass that along too. Okay, I think we've covered the main items — I'll send you a summary email after this with what we discussed, the two feature requests, and what our next steps are on our end. Does that work?