Fine-grained access control

Admin is a workspace-level role with full control over workspace content, members, and settings. Devops is an instance-level role focused on infrastructure: it has read access to all workspaces and can manage workers and view service logs, but cannot modify workspace content.

Yes. A workspace role is a set of capabilities: write code or not, compose or fully build flows and apps, manage schedules and triggers, and which pages are shown. Any workspace can override the default Developer and Operator roles, and Enterprise lets you define your own roles for the instance or a single workspace. Folder-level permissions (viewer, writer, admin) per group then decide which items each member can reach.

Windmill supports Google, GitHub, Azure AD, Okta, GitLab, and any OpenID Connect provider via OAuth. Enterprise adds SAML SSO and SCIM provisioning for identity providers like Okta, Azure AD, and OneLogin.

No. Secrets are encrypted at rest and injected at runtime only. They are never exposed in logs, the UI, or API responses. Workers receive decrypted values in memory only during script execution.

Yes. Enterprise supports JWT external auth to embed Windmill apps in existing portals or call the API with your own identity provider tokens. Windmill can also issue OIDC tokens for running jobs, allowing authentication with cloud providers (AWS, GCP, Azure) without storing long-lived credentials.

SAML/SCIM, JWT external auth, OIDC tokens, custom workspace roles, and secret key rotation require Enterprise. OAuth SSO, the built-in roles, groups, folders, encrypted secrets, and audit logs are available on all plans.

Yes. Windmill holds SOC 2 Type II certification (see trust.windmill.dev). The audit log records all actions for compliance. Enterprise customers get a 3-hour SLA for critical issues and access to the security team via a dedicated channel.