SSO, team, and departments

These three screens live under Governance. The Governance item in the top nav, and the Governance card on Settings, are there when the account includes governance. Settings says "SSO, IP Allowlist, Session Management, Departments, Team Management, Compliance Reporting, and Data Retention are now in the Governance section." The button is Go to Governance.

Team is also in the top nav, and on Settings. The Settings card says "Members and roles, pending requests, and invitations for colleagues." The button is Open Team. /meridian/settings/security/team redirects to /meridian/settings/team.

Single Sign-On (SSO)

The Governance card is Single Sign-On (SSO). The line under it is "Configure SAML 2.0 or OIDC". Back to Governance returns to Governance.

With no organization, the page title is Organization Required and the line is "You need to be part of an organization to configure SSO."

The page title is Single Sign-On (SSO). The line under it is "Configure SAML 2.0 or OIDC for your organization".

Before a configuration exists

The form is Configure your Identity Provider. Show setup instructions opens the steps for the selected provider. Hide setup instructions closes them. A provider with a docs link shows Docs.

Provider is Okta, Azure AD (Entra ID), Google Workspace, or Custom SAML 2.0. It starts on Okta.

Okta, Azure AD (Entra ID), and Custom SAML 2.0 show:

Google Workspace shows OIDC Client ID ("Client ID from IdP"), OIDC Client Secret ("Client secret"), and OIDC Issuer URL ("https://accounts.google.com"). Client ID is required.

Allowed email domains is required. The hint is "(comma-separated, e.g. acme.com, corp.acme.com)". The placeholder is "acme.com, mail.acme.com". The note is "Users with these email domains can sign in via SSO. Enter your company domains." An empty list says "Enter at least one allowed domain (e.g. acme.com)". A leading @ is dropped.

Advanced options starts closed. The three boxes start checked: Enforce domain restriction, JIT user provisioning, and Auto-create users on first login.

Create SSO Configuration sends it. While it saves, the button says Creating.... Success says "SSO configuration created. Enable SSO when ready." A failure says "Failed to create SSO config", or "Failed to save configuration" when the request cannot be read, unless the server sent its own message. A failed load says "Failed to load SSO config", or "Failed to load configuration".

Show setup instructions lists these steps.

Okta setup:

1. Go to Applications → Applications → Create App Integration
2. Choose SAML 2.0 and create
3. App name: Onaro Meridian (or your choice)
4. In the Sign-in tab: Copy Identity Provider issuer → paste as IdP Entity ID
5. Copy Identity Provider single sign-on URL → paste as SSO URL
6. Copy Identity Provider single logout URL → paste as SLO URL (optional)
7. Under Signing certificates, copy the certificate (X.509) → paste into IdP X.509 Certificate (include BEGIN/END lines)
8. Set Sign SAML response to Signed
9. Add attribute statements: email (user.email), displayName (user.firstName + user.lastName) if needed
10. Save. In our app, click Download SP Metadata and upload to Okta, or enter our ACS URL in Okta

Azure AD (Entra ID) setup:

1. Go to Microsoft Entra admin center → Applications → Enterprise applications → New application → Create your own
2. Name: Onaro Meridian
3. Go to Single sign-on → SAML
4. Copy Identifier (Entity ID) → paste as IdP Entity ID
5. Copy Login URL → paste as SSO URL
6. Copy Logout URL → paste as SLO URL (optional)
7. Under Certificate (Base64) → copy the certificate value → paste as IdP X.509 Certificate (include BEGIN/END lines)
8. Add optional claims: email, given_name, family_name for user provisioning
9. Download our SP metadata and set Identifier, Reply URL (ACS), and Logout URL in Azure from the metadata

Google Workspace setup:

1. Go to Google Admin Console → Security → Access and data control → API Controls
2. Or use the OAuth consent screen and create OAuth 2.0 credentials in Google Cloud Console
3. Create OAuth 2.0 Client ID (Web application)
4. Copy Client ID → paste as OIDC Client ID
5. Copy Client Secret → paste as OIDC Client Secret
6. Authorized redirect URIs: Add your callback URL (e.g. https://api.brianonai.com/api/sso/oidc/callback)
7. Issuer URL is typically https://accounts.google.com
8. Ensure your allowed domains include the Google Workspace domain (e.g. yourcompany.com)

Custom SAML 2.0 setup:

1. Obtain from your IdP admin: Entity ID, SSO URL, SLO URL (optional), and the IdP signing certificate (X.509)
2. Entity ID: Unique identifier for your IdP (often a URL)
3. SSO URL: Where users are redirected to authenticate
4. SLO URL: Where to send logout requests (optional)
5. X.509 Certificate: The IdP’s signing certificate (PEM format, include -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----)
6. Configure your IdP with our ACS URL and Entity ID (from SP metadata download)
7. Map attributes: at minimum, an email attribute for JIT provisioning

After a configuration exists

The heading is SSO is enabled or SSO is disabled. Enable SSO is the checkbox. Show setup instructions is still there.

The editable fields are Allowed email domains, and for a SAML provider IdP X.509 Certificate with the hint "(update if rotated)". Google Workspace shows OIDC Client Secret with "(update if rotated)" and the placeholder "Leave blank to keep current".

Save Changes stores it. Success says "SSO configuration updated." That message clears after a few seconds. A failure says "Failed to update", or "Failed to update configuration", unless the server sent its own message.

Download SP Metadata is shown for Okta, Azure AD (Entra ID), and Custom SAML 2.0. It is not shown for Google Workspace.

Next steps:

1. Upload the SP metadata to your IdP (Okta, Azure AD, etc.)
2. Configure the IdP to use our ACS URL and entity ID
3. Enable SSO above when ready
4. Users with allowed domains can click "Login with SSO" and enter their work email

Team and roles

The Governance card is Team Management. The line under it is "Invite members and assign roles". The page title, from the nav or from Settings, is Team. The line under it is "Members, roles, requests to join, and invitations."

While it loads, the page says "Loading the team…". A failed load says "Could not load the team", or "Could not load team members" unless the server sent its own message.

With no company, the page says "Create your company before inviting colleagues." The link is Your company.

When someone is waiting, the banner is "A colleague asked to join. Approve them and they are added. There is no second invitation to accept." More than one says the count, then "colleagues asked to join. Approve them and they are added." The same banner can appear above the page, from the app nav: "A colleague asked to join." or the count, then "Open Team to approve or decline."

Requests to join

The section is Requests to join. With none, the page says "No one is waiting."

Each row is the email and "Requested" plus the time, or "just now" when the time is missing. The role menu is Member or Admin. It starts on Member. Approve and Decline send the decision. Approve says "They have been added to the company." Decline says "Request declined." A failure says "Could not approve this request" or "Could not decline this request", unless the server sent its own message.

Members

The section is Members. The name line is the display name, or the email, or "No email". When a display name is shown, the email is on the next line, or "No email" when there is none. The role line is the role name. When that name is missing, the page uses Org Owner, Org Admin, Org Member, or Org Viewer, and otherwise Member.

An owner or an admin sees the controls. Someone else sees the list without them.

Allow rate cards and cost pools grants finance admin for rate cards and cost pools. It is checked and locked for an owner or an admin. Turning it on says "Finance rights allowed." Turning it off says "Finance rights removed." When a change was recorded, the line is "Allowed" or "Removed", then "by" and the person when one was recorded, then the time. A failure says "Could not update finance rights", unless the server sent its own message.

The role menu lists the organization's roles by name. It does not offer a separate finance role. Changing it asks "Change this user's role?" Success says "Role changed." A failure says "Could not change this role", unless the server sent its own message. A member with no role id shows No role until one is chosen.

Remove asks "Remove" the person's label "from the team?" Success says "Member removed." A failure says "Could not remove this member", unless the server sent its own message.

The last owner has no role menu and no Remove. The note is Last owner.

Invite colleagues

The section is Invite colleagues. The email placeholder is "colleague@company.com". The role menu lists the same roles except the owner role, and starts on Member when that role exists. Send invitation sends it. While it sends, the button says Sending…. Success says "Invitation sent." A failure says "Could not send the invitation", unless the server sent its own message.

Pending invitations are listed as the email, the role name, and "waiting to accept".

Departments

The Governance card is Departments. The line under it is "Cost allocation by team". Back to Governance returns to Governance. GL mapping for chargeback → opens GL Mapping.

The page title is Departments. The line under it is "Organize teams and track AI spend by department".

Four figures, when the summary has loaded: Total Departments, Total Budget, Current Spend, and Budget Alerts.

Budget Alerts lists each department as name, current spend, budget, and the percent. At or over 100 percent the notify control is "Get notified when departments exceed budget". Below that it is "Get notified when departments reach 80% of budget".

Add or edit a department

Add Department opens Create Department. The pencil on a row opens Edit Department with that department filled in.

Create or Update sends it. While it saves, the button says Saving.... Success says "Department created" or "Department updated". A failure says "Failed to create department" or "Failed to update department". Cancel closes the form.

The list and the detail

With none, the page says "No departments yet". Each row shows the name, the code when there is one, the monthly budget as an amount and "/mo" when there is one, the description, and the member count.

The trash icon asks "Delete" and the department name. Success says "Department deleted". A failure says "Failed to delete department".

Click a row to open it. Before a row is selected, the side panel says "Select a department to view details". The open panel heading is the department name. Current Month Spend shows the dollar total, then the percent "of" the budget when a budget is set, then the request count and the token count in thousands. Members shows the count. With none, the page says "No members assigned". A person is the display name, or the email, or "No email", then their role. A primary member is marked Primary.