Welcome to Atrium
The friendly control-plane on top of your identity stack — a directory, self-service access, a connector marketplace, and AI-native ops.
Atrium is the control-plane that sits on top of your identity provider and turns it into a product your whole company can use. Identity itself stays in the IdP (Zitadel today); Atrium owns the layer people actually touch every day: a directory of apps, a launcher, self-service access through groups, a marketplace of connectors to the tools around it, and an AI assistant that can answer and act on all of it.
The idea in one line: an open-source IdP gives you a powerful engine and a bare admin console — Atrium is the friendly, extensible layer that makes it usable at scale, for your own teams and (soon) for many isolated tenants at once.
What Atrium gives you
- A launcher — every user sees the apps they can open, one click away; apps they can see but not enter offer a one-click access request.
- Access through groups, not raw grants — an admin approves a request by adding someone to a group; a reconciler projects the real grant into the IdP. Membership is the source of truth, so revoking is just as clean. See Groups and Members & RBAC.
- A connector marketplace — email, error tracking, an LLM gateway, hosting and more are runtime-configurable Connectors: pick a provider, test it, enable it — no redeploy, keys encrypted at rest, swappable per tenant.
- AI-native ops — ask the AI agent in plain language, or wire Claude Desktop / ChatGPT over MCP; every answer and mutation respects your real permissions and is audited.
- Automation — run curated Actions when the IdP emits lifecycle events (onboarding, offboarding, auto-grant by department).
Start here by role
| You are | Start here |
|---|---|
| End user | Access requests for how to get into an app you can see but not open |
| App owner | Tutorial: publish an app, the full path from registering to rollout |
| Group owner | Groups for membership, child groups and what your group grants |
| App publisher | Publishing apps for what approving does and does not change |
| Script author | Actions overview, then the ctx API for the runtime surface |
| Admin | Tutorial: connect a connector, plus Access requests for the approval queue |
| Super admin | Members and RBAC for the role model and today's real enforcement, then the runbook |
| Machine integrator | API keys for scopes and the brokers, then MCP or the AI agent API |
New here and none of the above? Read How Atrium works, then Connectors.
Architecture, briefly
Atrium is the system of record for:
- app directory data
- Atrium groups
- script CRUD and version history
- payload samples and admin diagnostics
ZITADEL remains the system of record for:
- identity
- projects
- grants
- the action execution wiring itself