Operator sign-in with IAM.Identity
Open the Router operator console and distinguish it from a customer account.
An administrator must grant an existing operator profile access to your organization. IAM products share IAM.Identity, while each service checks its own permissions.
Sign in
- Open the correct console: production app.iamrouter.ru or staging.
- Select Sign in with corporate SSO. An existing IAM.Identity session in this browser profile may complete sign-in without another password prompt.
- Check your account and the Clients, Groups, Policy, Data classes and Quotas menu entries. Reload the page to verify session restoration.
- Do not enter an inference API key as a password. This sign-in path requires neither copying an administrator token into the browser nor creating another account.
Sections and permissions
| Section | Meaning |
|---|---|
| Clients | LLMOps worker clients and local models, separate from hosted customer accounts. |
| Groups | Worker groups with server-checked visibility and membership. Creating a group does not grant hosted Secure access. |
| Customer administration | Hosted customer access, monthly limits and request rates. |
| Policy / Data classes | Routing protection controls. Viewing reports and changing protection require different permissions. |
On the verified staging deployment, an existing authorized IAM.Identity operator session opens gateway and LLMOps sections. Successful customer SSO alone does not grant operator access.
Verify
Check your account, access to the required section and restoration after a page reload. Verify each setting separately: reread it after saving and send a control request in your own test tenant. A saved notification alone does not prove application on every gateway replica.
Recover
- Customer account is not connected: Identity sign-in succeeded, but this profile has neither a hosted account binding nor recognized operator access. Ask the administrator to verify product binding and assigned permissions; registering a duplicate does not fix it. After the binding is corrected, select Retry below the message; to change accounts, use the separate Sign out button. The buttons have spacing above and between them and wrap with that spacing on narrow screens.
- Access denied: request a check of permission for that section. An IAM.Market role does not automatically authorize Router administration.
- Wrong account: use a separate browser profile or sign out of the current session. Global IAM.Identity logout may also end other IAM product sessions.
- Different values after saving: stop repeating writes and provide the administrator with the tenant, time and Request ID. Saving from a stale screen can overwrite a newer version.
2026-10-15 · Actual staging application after normal sign-in with a separate synthetic nonoperator account. Retry rechecks access; Sign out returns to the login form. Operator session and permissions were unchanged. Original pixels are unmodified.
- Retry
- Sign out