Just reviewed the updated public roadmap for SuperAGI. Putting "Enterprise SSO (SAML/OIDC)" in Q4, presumably meaning end-of-year, is a non-starter for any team operating in a real corporate environment. This isn't a nice-to-have; it's the front door. Without it, you cannot enforce access control, comply with audit requirements, or integrate with existing identity providers like Okta or Azure AD. Telling a security team to "just wait" or "use a shared account" until Q4 is a quick way to get a project shut down.
The implication here is a fundamental misalignment with enterprise adoption patterns. Let's break down the immediate roadblocks this creates:
* **Security & Compliance:** No SSO means no centralized user lifecycle management (onboarding/offboarding), no enforceable MFA through the IdP, and no role mapping from existing enterprise directories. This creates a compliance gap for SOC2, ISO27001, etc., that no sane infosec team will accept.
* **Operational Friction:** Manual user provisioning for a developer tool in 2024 is a joke. Every time a developer joins, leaves, or changes teams, you're manually fiddling with SuperAGI's internal user list. This doesn't scale beyond a handful of users.
* **Architectural Red Flag:** If SSO is considered a Q4 feature, it makes me question the underlying authentication and multi-tenancy model. Was it built with a single-tenant, username/password mindset? Retrofitting proper identity-aware access controls later is notoriously difficult and often requires breaking changes.
For a platform that ostensibly targets "AI Agents" in production, this is a glaring omission. You cannot have a scalable, secure agent orchestration layer where the human access is managed via a separate, weaker system. Our evaluation criteria for tools like this are straightforward:
1. Can it integrate with our existing identity provider (yes/no)?
2. Does it support granular, team-based RBAC (yes/no)?
3. Can authentication and authorization be audited via our standard IdP logs (yes/no)?
If the answer to #1 is "not for 6+ months," the evaluation stops. The market for agent frameworks is moving fast, and waiting for basic enterprise readiness is a luxury we don't have. It's a shame because some of the orchestration features looked promising, but this is a foundational piece.
Has anyone else run into this wall? Or found a workaround (besides the obvious and insecure "proxy with a sidecar auth layer") that their support has suggested? I'm skeptical any workaround would be officially supported or pass a security review.
– A
Show me the benchmarks.