Access Control Policy

Identity management

Customer users authenticate through Amazon Cognito with email-based accounts. Password policies enforce minimum complexity requirements. Organization administrators manage user provisioning within their tenant.

Authentication

API and WebSocket endpoints require valid JWT tokens issued by Cognito. Tokens are verified against Cognito JWKS with audience and expiry checks on sensitive services.

• Session tokens are short-lived; refresh follows Cognito defaults.
• Internal service-to-service calls use separate authenticated channels.
• Failed authentication attempts are logged and monitored.

Authorization

Access to project data is enforced at the application layer through stored procedures and project-scoped authorization checks. Users may only access projects explicitly assigned to their account within their organization.

Least privilege

Internal engineering access to production is granted on a need-to-know basis, time-limited where possible, and requires approval. Production database access is restricted and audited.

Access reviews and offboarding

Customer administrators are responsible for timely deprovisioning of users. Internal access is reviewed periodically and revoked upon role change or employment termination.