— SECURITY · 04 OF 07 · AUTHN + AUTHZ

Who can do what. In writing.
Everything logged.

Three identity surfaces: customer-side users, the Cyborg itself, and Aliens engineers. Each has separate authentication, separate scope, separate audit trail. The principle is least-privilege everywhere; the bar is “the engineer cannot read your data without your real-time approval.”

AUTHSSO + MFA mandatory
AUTHZ MODELRBAC + scoped grants
BREAK-GLASSCustomer real-time approval
SESSIONJWT + 8-hour TTL

01Customer-side RBAC.

You manage who in your org can talk to your Cyborg. Four built-in roles, customisable per workspace.

Role
Can do
Cannot do
Owner
Everything · manage billing · add/remove members · revoke tool grants · terminate Cyborgs
n/a
Manager
Approve Cyborg actions at T2/T3 · review reports · modify SOPs · raise incidents
Billing · member management
Member
Interact with Cyborg in shared channels · submit feedback · view own audit log
Approve T3 actions · modify configs · see other members’ logs
Auditor
Read-only access to all audit logs, reports, configs across the workspace
Any write action

SCIM provisioning + SSO are available on Business and Enterprise plans. MFA is mandatory for Owner / Manager / Auditor; recommended for Members.

02Cyborg-side scopes.

The Cyborg holds OAuth tokens for the third-party tools you authorise. Every grant is scoped to the smallest possible boundary, logged, and revocable in one click.

  • Repo-scope · access to specific repositories, not full GitHub account.
  • Channel-scope · access to specific Slack/Teams channels, not entire workspaces.
  • Folder-scope · access to specific Drive / SharePoint folders, not full account.
  • Project-scope · for Linear / Jira / Asana: per-project, not per-organisation.
  • Time-bound · grants can be set to expire after N days; auto-revoked at TTL.

Tokens live in the Cyborg’s VM keystore, encrypted with the per-customer KEK. They never leave the VM. Token rotation is automatic where the upstream tool supports it.

03Aliens engineer access.

Aliens engineers maintain the platform. They occasionally need to debug an incident on a specific customer’s VM. The bar for this is high and the path is fully observable.

  • No standing access. No engineer has permanent access to any customer’s VM. Default = zero.
  • Break-glass workflow. When debugging requires VM access, the engineer files a justification + scope (read-only / read-write / specific paths) + duration. Approval routes to the customer-side Owner.
  • Customer real-time approval. The Owner sees the request in their dashboard immediately, with the engineer’s name + scope + timestamp. They click Approve or Deny.
  • Live observation. Approved sessions stream every command to the Owner’s dashboard. The Owner can revoke mid-session.
  • Session record. Full session is recorded (commands + outputs) and archived to the audit log. Default retention: 7 years.

Founder commitment.

The break-glass system is enforced at platform level — not a policy. There is no “admin override” that bypasses customer approval. If the platform allowed it, A’nil himself couldn’t read your VM. Yeh architectural hai — promise nahi.

04Session & credential.

  • Session TTL: 8 hours default; 1 hour for Auditor role; 30 min for Aliens-engineer break-glass.
  • Idle timeout: 30 min idle = automatic re-auth.
  • Refresh tokens: rotated on every use; previous token immediately invalidated.
  • Password policy: minimum 12 chars, NIST 800-63B aligned. Compromised-password check on every change against HIBP-style lists.
  • MFA: TOTP (Authenticator apps) and WebAuthn / FIDO2 supported. SMS OTP available but not recommended (sim-swap risk).
  • Account lockout: 5 failed attempts → exponential backoff. Permanent lockout requires Owner unlock.

05What we don’t do.

  • No silent admin login. No API endpoint Aliens can call to read your VM without your knowledge.
  • No “trust me” support flows. Support engineers ask for your screen-share when needed; they don’t request VM access casually.
  • No long-lived API keys. Programmatic API keys (for your own automation) max TTL 90 days; auto-rotation reminders 14 days before expiry.
  • No password-only auth. MFA is mandatory for sensitive roles; recommended for everyone.