windsurf-enterprise-rbac

# Windsurf Enterprise RBAC ## Overview Manage enterprise Windsurf deployment: SSO/SAML configuration, role-based seat management, organization-wide AI policies, and admin portal controls. Covers Teams and Enterprise plan features. ## Prerequisites - Windsurf Teams ($30/user/mo) or Enterprise (custom pricing) plan - Organization admin access at windsurf.com/dashboard - Identity provider for SSO (Enterprise only): Okta, Entra ID, Google Workspace ## Instructions ### Step 1: Configure SSO / SAML (Enterprise Only) Navigate to Admin Dashboard > Security > SSO: ```yaml # SSO Configuration Steps sso_setup: 1_choose_idp: supported: ["Okta", "Microsoft Entra ID", "Google Workspace", "Any SAML 2.0 IdP"] 2_configure_saml: entity_id: "https://windsurf.com/saml/your-org-id" acs_url: "https://windsurf.com/saml/callback" # Get these from Admin Dashboard > SSO > SAML Configuration 3_idp_settings: # Configure in your IdP: sign_on_url: "https://windsurf.com/saml/login/your-org-id" audience_uri: "https://windsurf.com/saml/your-org-id" name_id_format: "emailAddress" attribute_statements: email: "user.email" firstName: "user.firstName" lastName: "user.lastName" 4_enforce: enforce_sso: true # Block password login after SSO is verified auto_provision: true # New IdP users get Windsurf seats automatically domain_restriction: ["yourcompany.com"] # Only allow company emails ``` ### Step 2: Configure Roles and Permis...