01 / MONDAY · 09:04
A new analyst starts.
They sign in with the login they already have. Their IdP group maps to a role, so access follows your directory instead of another set of credentials to manage.
IDENTITY PROVIDER → DESK ACCESSFEXR / TEAMS & FUNDSFEXR DESK
A workspace built around your desk.
Your desk.
Your desk.
Your agents.
One control room.
Fexr Desk brings your people, agents, intelligence and execution controls into one workspace. SSO, roles, per-agent identity and a signed audit trail—deployed, not hand-rolled.
Your identity provider. Your permissions. A trail you can verify.
WORKSPACE / YOUR FUNDCONCEPTUAL VIEW
ONE WORKSPACE BOUNDARYSeparate identities.
Shared oversight.
Shared oversight.
PEOPLE / YOUR DIRECTORY
OwnerWorkspace control
↗Security adminSecurity oversight
↗MemberAssigned desk access
↗AGENTS / DISTINCT KEYS
Signal feedOwn credential
◇ExecutionOwn credential
◇ResearchOwn credential
◇WORKSPACE SECURITY EPOCH
Action
recorded→Receipt
signed→Chain
verifiable
recorded→Receipt
signed→Chain
verifiable
01 / ACCESSYour existing SSO.Connect the directory you already run.
02 / IDENTITYA key for every agent.Credentials aren't shared across the fleet.
03 / EVIDENCESigned. Chained. Verifiable.Review the actions behind the outcome.
01 / Inside one workspaceEvery person.
Every person.
Every agent.
One signed trail.
People and agents are provisioned separately. A workspace security epoch—a version on its credentials—lets you invalidate workspace access in one action and trace what was authorized.
THE IDENTITY MODEL / ONE WORKSPACEARCHITECTURE SCHEMATIC
Access control is not a promise of investment safety. Identity and audit controls govern who can act. Market risk and strategy risk still need their own limits.
Explore agent controls02 / How the desk runsThree moments.
Three moments.
One operating model.
The value is in the ordinary work: onboarding a person, isolating a new agent and responding when access needs to stop. These are illustrative desk scenarios, not customer incident reports.
03 / Works with your stackKeep the tools.
Keep the tools.
Connect the desk.
Your identity provider, your alerting and your audit tools. Standard interfaces bring the workspace into the way your team already operates.
Your identity provider.
OIDC / EXISTING DIRECTORYOkta, Azure AD, Google Workspace. Sign-in follows the directory you already run.
Not locked to a vendor.
STANDARD OIDC ISSUERSAuth0, PingIdentity or your own standard OIDC issuer. Your identity model doesn't need to become Fexr-specific.
Audit outside the dashboard.
SIGNED RECEIPT EXPORTExport the signed receipt chain for independent review in your audit and SIEM workflows, including Splunk or Datadog.
Alerts where your team looks.
SLACK / TELEGRAM / EMAILRoute security and trading alerts to the channels your desk already watches.
04 / From directory to deskConfigure first.
Configure first.
Build only if you want to.
Most desks configure from the dashboard. Programmatic access stays available to the quants and developers who need it—not as a prerequisite for everyone else.
- 01
Connect your SSO.
Bring your OIDC identity provider and directory provisioning.
- 02
Assign desk roles.
Set the access appropriate for each person on your team.
- 03
Register your agents.
Give each agent its own credential and scope.
- 04
Review the trail.
Inspect signed receipts and confirm your team's operating model.
Zero code.
Full desk oversight.
Configure SSO, assign roles, register agents and read the audit trail from the dashboard. For most teams, the rollout starts with the SSO connection—not an integration project.
See it in a walkthrough ↗Your code.
The same identity model.
REST, MCP, webhooks and typed SDKs for teams that want to build. The JavaScript/TypeScript SDK is public; Python, Rust, Dart and a CLI are used internally and released to teams as needed.
Read the API documentation ↗05 / The detail behind the designGo deeper.
Go deeper.
Know what you're deploying.
Explore the interfaces, the Desk plan and the permission checks behind each action.
01 / REFERENCE
API documentation.
The REST and MCP surface for teams that want to build on it.
Read the docs ↗02 / THE PLANDesk, in full.
Pricing, workspace configuration, identity and security details.
Explore the plan ↗03 / THE CONTROLSAgentic safety.
How an agent's permission is checked before it acts and how access is revoked.
Understand the checks ↗06 / Before your desk goes liveGood questions.
Good questions.
Clear answers.
For the people running the desk—and the people reviewing it.
Talk through your setup ↗What does a team or fund need to build to use Fexr?
For most teams, nothing. Connect your identity provider, assign roles, and the desk is live — SSO, per-agent identity, and the signed audit trail are already built. The API and SDKs stay available for teams that do want programmatic access.
How does SSO work?
Sign in through your own identity provider over OIDC — Okta, Azure AD, Google Workspace, or any standard OIDC issuer. Roles and deprovisioning follow your IdP automatically through SCIM.
Does every agent our desk runs get its own credential?
Yes. Every agent — a strategy, a signal feed, a goal session — carries its own signing key. Nothing is shared across your fleet, so revoking one agent never touches the rest.
Can compliance verify the audit trail independently?
Yes. Every fund-affecting action produces an Ed25519-signed receipt chained to the one before it, verifiable against our published key at /receipt-keys — not something you have to take on trust.
YOUR NEXT MOVELet's get
Let's get
your desk live.
Bring your team's setup. We'll walk through the identity, permissions and audit workflows that matter to your desk.
Building with agents? Explore Fexr LLM Skills ↗