When funds are advanced on a loan, every service involved should know who asked.

In Elevations, they do.

Take a single advance on a development loan. It starts with a sign-in through Amazon Cognito — usually via the identity provider the lender already uses, such as Microsoft Entra ID (including synced on-premises Active Directory) or Okta — with multi-factor authentication applied on the way in. Cognito hands back a signed token that says who the user is and what role they hold.

That token then travels with the request. An advance touches several parts of Elevations — the loan, its tranches, the schedule, transactions, exposure groups — each its own independent service — and external services too. The same token is passed along every step of the chain. Each service knows who is asking and what they're allowed to do, instead of trusting a shared back-door credential to speak for everyone, like some legacy systems.

What they're allowed to do depends on their role. Administration roles cover product set-up: the rules that define how a type of loan behaves. Operational roles cover the day-to-day work of lending — approving a loan, advancing funds against it. Being able to change how a product works doesn't automatically mean being able to release money against it.

That's the point of building identity into the chain rather than bolting a login on the front. “Who did this, and were they allowed to?” has an answer at every step, client and server, not just at the front door.

For a system that moves money, that isn't an extra. It's what lets a lender trust it to.