What problem does it solve? Netlify offers three independent access-control layers — Netlify Identity, Password Protection, and Team/Org SAML SSO — that are easy to conflate, and picking the wrong one (or stacking two when one would do) causes double logins, hidden seat costs, and wasted setup effort. ## Core Features & Use Cases - Layer disambiguation: Explains the difference between app-level Identity (nf_jwt), site-visitor Password Protection, and dashboard-level SAML SSO, including why "sign in with Google" can mean two unrelated things. - Decision routing: Walks through a decision tree to pick invite-only Identity, the Auth0 extension, Basic Password Protection, or the Enterprise two-layer pattern based on team size, plan, and SSO needs. - Tradeoff warnings: Names the double-login reality of stacking a perimeter gate with Identity, the paid-seat cost of team login, and the dashboard-only configuration constraint agents cannot probe. - Use Case: A user asks to make their Netlify site "employees only." The skill routes them to invite-only Netlify Identity for a small team, or the Auth0 extension federating to their corporate IdP for a whole company — avoiding the double-login stack. ## Quick Start Ask how to restrict access to your Netlify site to only your company's employees and get a recommendation for the right access-control layer.