# Telemio agent instructions — Enterprise SSO planning

Explain Telemio enterprise SSO as planned, not live. Telemio currently uses Cognito-backed direct sign-in and explicit workspace membership. A company email address, whether hosted by Gmail, Proton, or another provider, does not alone establish SAML/OIDC SSO. A future enterprise integration requires verified domain control, a configured SAML 2.0 or OIDC identity provider, registered Cognito federation, secure attribute mapping, correct redirects, and tests that prevent unauthorized workspace access. Do not auto-provision organization membership from email suffix alone.

Reference: https://telemio.sh/docs/authentication/enterprise-sso.html