One login for the whole AI estate: a launcher that knows which platform is live, keeps the session shared, and opens each product exactly where the user left off.
Each platform had its own login and its own session, so moving between them meant authenticating again and starting over with no shared context. The team looked like five separate products instead of one estate.
We made identity the product. OnePlatform authenticates once against the workspace identity provider, then issues a signed session token that each downstream product verifies independently. Session state is shared through the portal, while every product keeps its own authorisation rules.
Screenshot from the running project.
One sign-in against the workspace identity provider produces a signed token that every downstream product accepts, so authentication happens once instead of once per tool.
Screenshot from the running project
Products open with the session already in place, carrying the user to the screen they were last working on rather than to a generic landing page.
Screenshot from the running project
Agents and workflows published inside OneEngine appear in the portal catalog automatically, so a released capability is discoverable without anyone maintaining a second list.
Screenshot from the running projectEach product is listed with its real maturity - live, beta, or in development - so the portal never advertises a platform that is not ready yet.
Health of the API gateway, authentication service, and AI runtime is shown at a glance, which turns 'the tool is broken' into a specific, answerable question.
One login now covers the whole estate. Launching a product no longer means authenticating again, and the portal reports which services are healthy at a glance instead of each product failing silently on its own.
OnePlatform started from a simple observation: the tools were fine, the switching was not. Every product had its own login, its own session, and its own idea of who the user was, so moving between them meant signing in again and losing context.
The fix was to make identity the product. OnePlatform owns the session, authenticates once against the workspace identity provider, and hands a signed token to each product it launches. From the user's side there is one account; from the platform's side every product still verifies authorisation on its own.
What it became is a control surface rather than a splash screen. It shows which platforms are live, which are still in beta, what the session's security posture is, and where to go next. The dashboard is deliberately calm, because a launcher's job is done the moment it has put the user in the right place.