Bishal Saha
Bishal Saha

I am an Enterprise Software Engineer and AI Solutions Architect with over 15 years of professional experience designing and building secure, scalable, and intelligent software solutions. After earning my Bachelor of Technology (B.Tech.) in Bioinformatics, I built my career across full-stack software development, enterprise architecture, cloud-native applications, and modern DevOps practices. Today, I specialize in developing end-to-end digital products that combine robust software engineering with cutting-edge technologies such as Generative AI, Agentic AI, RAG, and MCP.

Contact Me

Newsletter

Follow Me

Aegisense Multi-Tenant Identity and Authorization Platform

Aegisense Multi-Tenant Identity and Authorization Platform

AegiSense Enterprise IAM Platform

Building a Self-Hosted, AI-Native Identity and Access Management Platform

 

Overview

Modern enterprises depend on identity for every digital interaction, yet most organizations still rent this critical capability from SaaS providers. That model breaks down when data sovereignty, regulatory compliance, on-premise deployments, or escalating per-user licensing become business constraints.

AegiSense was built as an enterprise-grade alternative: a fully self-hosted Identity & Access Management platform that combines authentication, authorization, federation, governance, and AI-powered administration into a single cohesive product.

Instead of stitching together multiple security tools, organizations gain one intelligent platform they own, customize, and deploy anywhere—with AI-powered administration and Agentic AI that automate access management, security operations, and identity workflows.

Role

Enterprise Architect · Lead Engineer · AI Systems Designer
Enterprise IAM

Self-hosted identity platform

Multi-tenant

White-label SaaS architecture

RBAC · ABAC · ReBAC

Unified authorization engine

AI-native Operations

Natural language administration

Problem

Identity you rent versus identity you own

Every company past a certain size needs the same things — authentication, fine-grained authorization, SSO with partners, user lifecycle, access reviews for auditors, security-incident visibility. Renting all of it from a SaaS vendor fails for regulated industries that can’t export their identity graph, for on-premise-only deployments, for anyone who has renegotiated per-active-user pricing at scale, and for service providers who want to offer their own branded identity product.

AegiSense is built for those situations:

  • Self-hosted. No identity data leaves your perimeter.
  • One authorization engine, not three products. Roles, attribute policies, and relationship checks resolve through a single decision point.
  • Multi-tenant and white-label from day one. One installation serves a fleet of isolated tenants, each with its own users, policies, branding, and verified custom domain.
  • Complete. Federation, identity governance, and security operations are in the box, not sold separately.

Architecture

One monolith, one decision point, three isolation layers

A modular monolith, deliberately. One deployable Spring Boot application, internally organised as eleven bounded-context modules via Spring Modulith. One build, one database, transactional consistency, no distributed-systems tax before it was needed — and module boundaries with their allowed dependencies areverified in the test suite, so the monolith stays decomposable and nothing rots.

The SPI-port pattern. Modules that need each other’s behaviour depend only on interfaces owned by the shared platform module, which the providing modules implement — hexagonal architecture at the module level. It kept the dependency graph acyclic through ten phases and resolved three real cycles.

One Policy Decision Point. Every access decision goes through a single engine: evaluate(principal, resource, action, context) → PERMIT | DENY. It composes the RBAC layer (cached role-hierarchy resolution), the ABAC layer (per-request attribute policies), and relationship checks, with deny always winning. The authorization module’s tables are internal — no other module can hand-roll a permission check.

authenticationfederationgovernancesecurityenterpriseauthorizationthe Policy Decision Pointusertenantorganizationplatforminfrastructure + SPI ports — SodPolicyChecker, LoginRiskEvaluator, NotificationSender, SsrfGuard…implements SPI portdepends on ↓
Dependencies point downward only. Behaviour needed upward is reached through aplatform-owned interface the provider implements — the dashed return edge.

Full federation. An OAuth2/OIDC provider (Spring Authorization Server, per-tenant clients), SAML 2.0 as both IdP (hand-built on OpenSAML) and SP, SCIM 2.0 provisioning, LDAP/Active Directory, and social login — every path terminating in the same authentication flow and the same PDP.

An AI service, deliberately separate. A FastAPI service that is a client of the core — it calls back through the authenticated REST API with a scoped service account, has no direct database access, and every action it can take is a registered tool that calls through the same authorization engine as every other path. It provides natural-language administration, risk-score explanation, least-privilege policy recommendations, RAG over policy and audit data (pgvector), and an MCP endpoint for external agents — all under the requesting admin’s own permissions.

Two hard problems

Where the interesting engineering was

Defense-in-depth tenant isolation

RLS alone is a false sense of security: FORCE ROW LEVEL SECURITY is bypassed by a PostgreSQL superuser, and connection credentials often are superusers. The fix was an unprivileged database role plus a Connection proxy that pins tenant context — SET LOCAL ROLE and the tenant session variable — before every statement, with Flyway routed through a dedicated connection-details bean so migrations still run with full privileges. Three enforced layers, default-deny, verified adversarially in CI.

query ↓1  ·  Applicationservlet filter sets a thread-local TenantContext from the JWT / verified domainbefore business code2  ·  PersistenceConnection proxy: SET LOCAL ROLE app_role + bind tenant GUC, every statementunprivileged — RLS applies3  ·  DatabaseFORCE ROW LEVEL SECURITY on every table — filter on the GUC, deny by defaultonly correctly-scoped rowsthe gap layer 2 closesa superuser connectionignores FORCE RLS — soevery statement is pinnedto a NOLOGIN role thathas no such exemption.
An adversarial cross-tenant read test runs in CI on every build: authenticate as one tenant, try several attack shapes to read another’s rows, come back empty.
SSRF-hardened outbound delivery

Webhooks and notifications call customer-controlled URLs — a server-side request forgery vector (point one at the cloud metadata endpoint, use the delivery log as a port scanner). The SsrfGuard in platform enforces scheme allow-listing, rejection of private / loopback / link-local / metadata ranges for bothIPv4 and IPv6 by raw-byte checks (the JDK’s isSiteLocalAddress() misses modern unique-local IPv6 and would let the AWS IPv6 metadata address through), redirect validation, and response-body suppression. Delivery runs outside the caller’s transaction with bounded timeouts.

A related choice: ABAC policy conditions — authored by tenant administrators — use Google’s Common Expression Language, not Spring Expression Language. Non-Turing-complete and sandboxed, so a tenant-authored expression can’t reach arbitrary code.

Outcome

An intelligent identity platform, not just an identity store

A working, self-hostable identity platform: unified RBAC/ABAC/ReBAC authorization behind one decision point; multi-tenant isolation enforced at three layers and tested adversarially; a complete federation suite; identity governance and security operations built in; enterprise platform services (workflow engine, notifications, reporting, billing, white-label branding, plugins, signed webhooks, observability, backup/restore); an AI service for natural-language administration and policy intelligence under strict authorization guarantees; and an Angular admin console covering all of it at WCAG AA.

What I delivered
  • Unified RBAC / ABAC / ReBAC behind one decision point
  • Three-layer tenant isolation, verified adversarially
  • OAuth2/OIDC provider, SAML2 IdP + SP, SCIM, LDAP/AD, social
  • Identity governance: access requests, certifications, SoD, joiner/mover/leaver
  • Security operations: adaptive MFA, passkeys, device trust, threat detection, compliance
  • Enterprise services: workflow, notifications, reporting, billing, white-label, plugins, webhooks, observability, backup/restore
  • AI: natural-language administration, risk explanation, policy recommendations, MCP endpoint
By the numbers
  • 11 backend domain modules, dependency-checked in CI
  • ~1,000 backend source files, ~87.5k lines
  • ~87 REST controllers, ~290 endpoints
  • 85 JPA entities, 87 Flyway migrations
  • ~1,050 backend + ~490 frontend automated tests
  • 31 admin-console feature areas
  • 25 architecture decision records
  • 10 reviewed phases, ~2 months

At a glance

11

Domain modules, dependency-checked in CI

~290

REST endpoints across ~87 controllers

~87

Flyway migrations 85 JPA entities

~1,540

Automated tests ~1,050 back / ~490 front

31

Admin-console feature areas

10

Reviewed phases, ~2 months

25

Architecture decision records

79%

Test coverage (65% CI gate)

Tech stack

What it’s built with

BackendSpring Boot 4.1 · Java 25 · Spring Modulith · Spring Data JPA · Spring Security
DataPostgreSQL (row-level security) · Flyway · Redis (Lettuce)
AuthZ / protocolsSpring Authorization Server · Spring Security SAML2 (SP) · OpenSAML (IdP) · Google CEL
AuthN / cryptoNimbus JOSE JWT · TOTP + ZXing · Yubico WebAuthn (passkeys / FIDO2) · BouncyCastle
Security opsMaxMind GeoIP2 (impossible travel) · Bucket4j (rate limiting) · HaveIBeenPwned k-anonymity
EnterpriseApache POI + OpenPDF · AWS SDK v2 (S3) · OpenTelemetry → Jaeger / Loki / Grafana
FrontendAngular 21 (standalone, signals, OnPush) · Bootstrap 5 · AdminLTE 4 · Chart.js · Vitest
AI serviceFastAPI (Python) · provider-agnostic LLM gateway · pgvector (RAG) · Model Context Protocol
Build / qualityGradle (Kotlin DSL) · Spotless · Checkstyle · JaCoCo · CycloneDX SBOM · GitHub Actions · Testcontainers