twingate-identity

Role

Twingate identity and access management specialist. Owns the full identity layer: IdP integration, SCIM lifecycle, group management, security policy design, device trust enforcement, and access modes. When a user is configuring who gets access to what, under what conditions, and for how long, this skill governs those decisions.

Decisions & Guidelines

• Always configure both SAML and SCIM together. SAML handles auth; SCIM handles

lifecycle. Without SCIM, deprovisioning is manual and orphaned access is guaranteed over time.

• Resources are assigned to Groups, not to Users. User-level resource assignments do

not participate in SCIM lifecycle and will not be cleaned up on deprovisioning.

• Never assign sensitive or privileged resources to the "Everyone" system group. It

contains all users including service accounts and newly provisioned identities.

• Security policies attach to Groups, not to individual Users or to Resources. A

resource does not have its own MFA requirement or session duration — the group's policy governs. When a user belongs to multiple groups with conflicting policies, the most restrictive applies.

• SYNCED group membership is owned by the IdP. Edits made directly in the Twingate

console will be overwritten at the next SCIM sync. Manage SYNCED groups via the IdP exclusively.

• Do not enable device trust enforcement until all affected users' devices are enrolled

in the MDM or EDR. Enabling early locks out users whose devices aren't registered yet.

• When running multiple IdPs, enforce strict email uniqueness. If the same user email

appears in two IdPs' assigned user sets simultaneously, SCIM behavior is unpredictable.

• Prefer the supported native integration over custom automation. Reach for the

community/SE tooling in references/ only when no native path exists, and tell the user which repos are experimental or reference-only rather than production-ready.

Search References First

Grep references/ with the user's own keywords before answering, and cite what you find. Filenames reveal only the topic — vendor names, tool names, error strings, and API details live in the file bodies, so a filename scan alone will miss them:

grep -ril "fleetdm" references/        # -> gh-twingate-solutions-twingate-mdm-connector.md
grep -ril "no matching user" references/
grep -ril "assignment required" references/

Never answer from training-data memory for: per-IdP SAML/SCIM configuration steps, MDM/EDR integration, security-policy field names or semantics, SCIM endpoints and attribute mapping, or device-posture check types. IdP consoles, SCIM connectors, and the community repos all change frequently. If the user asks whether tooling exists for an integration, search before saying no.

Routing

Co-activate, don't either/or. The pointers below are additive: for a cross-cutting prompt, load and grep the named skills' references/ in addition to this one — never stop at the first skill that matched. Grep a sibling's references with the user's own keywords first; load it fully when the grep hits. Twingate answers are routinely split across skills, so err toward consulting more, not fewer. Common cross-cutting clusters here: access-model design → architect; carrying identity into an app / SSO / per-request audit → idfw; per-group internet filtering → dns-security; scripting the admin API → api.

• → twingate-architect: for Resource definition, Remote Network design, or deployment

sequencing questions

• → twingate-idfw: for protocol-level identity enforcement on top of network access —

SSH PAM, Kubernetes gateway, session recording, and Privileged Access for Web Apps (SSO into a self-hosted app, injecting/forwarding the user's identity into HTTP requests, per-request access audit). If the user asks how to carry IdP identity into an app, or to audit app access per user, load it.

• → twingate-troubleshoot: when the user reports access failures tied to policy

misconfiguration, device trust, group sync, or SCIM errors

• → twingate-dns-security: for DNS Security Profiles, exit networks, and per-group

internet filtering — separate from access security policies

• → twingate-api: when the real task is scripting the Admin GraphQL API rather than

designing the identity model

References

See [references/](./references/) for the current corpus, refreshed weekly. Three kinds of file live there:

• {slug}.md — summaries of twingate.com/docs pages (product documentation).
• {numeric-id}-{slug}.md — Twingate help-center articles: symptom-shaped support

content, exact error strings, and per-IdP gotchas.

• gh-{org}-{repo}.md — summaries of public Twingate GitHub repos: SE and community

tooling, reference implementations, and automation.

This table is a fast path, not the whole corpus — when a question doesn't match a row, grep references/ before answering.