Bring your own SAML identity provider. Users sign in through your IdP and are JIT-provisioned into deny.sh on first login. Every login is recorded in the audit chain, so IT and security teams can trace access.