> ## Documentation Index
> Fetch the complete documentation index at: https://docs.avoca.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Identity and Access Controls

> Identity, access management, and insider risk safeguards enforced across Avoca.

# Identity and Access Controls

## Access Review Cadence

Quarterly access and permission reviews ensure principle of least privilege is maintained across all systems. Reviews encompass:

* User access levels across all organizational systems
* Role appropriateness and continued business need
* Shared account credential rotation (quarterly minimum)
* Documentation updates in Google Workspace and compliance platforms

***

## Multi-Factor Authentication

MFA is enforced for all administrative access to critical systems, providing an essential additional layer of security beyond password-based authentication. This requirement extends to:

* Cloud infrastructure management consoles
* Administrative panels for SaaS applications
* Database administration tools
* Code repository administrative functions

***

## Least Privilege & Separation of Duties

Avoca implements comprehensive least privilege principles throughout our environment:

* **Default Read-Only Access**: Users receive read-only permissions by default, with write or administrative privileges granted only as required by role
* **Single Sign-On (SSO) Integration**: SAML/OAuth integrations leveraged wherever possible to centralize identity management and enable rapid access revocation
* **Individual User Accounts**: Shared or tiered accounts are avoided in favor of individual user accountability; exceptions (service accounts for integrations) are managed in 1Password with role-based access restrictions
* **Automated Onboarding/Offboarding**: Access provisioned only to systems required for role performance; immediate access revocation upon offboarding (automated via PEO plus SSO integration targeted for Q1 2026)

***

## Authentication & Authorization Architecture

**Enterprise Authentication Infrastructure**

* **Protocols**: OAuth 2.0 and OpenID Connect (OIDC) supported throughout the platform
* **Third-Party Authentication**: Authentication services offloaded to professional providers (Supabase, Google OAuth), eliminating risks associated with proprietary authentication implementations
* **MFA Availability**: Multi-factor authentication available for enhanced account security across user-facing systems
* **Enterprise SSO**: Integration capabilities available based on specific customer requirements and configuration needs

**Role-Based Access Control (RBAC)**

* **Team-Based Permissions**: Comprehensive RBAC implementation with database-level row security policies
* **Data Isolation**: Complete data segregation between teams or customers enforced at the database layer
* **Access Management**: Role and team assignment structures provide granular control over system and data access
* **API Security**: All publicly accessible endpoints require authentication (JWT, API key, or OAuth depending on use case)

***

## Insider Threat Protection

Avoca employs comprehensive controls to protect against both malicious and accidental insider threats.

**Access Controls**

* Role-based permissions throughout all systems
* Principle of least privilege enforced at onboarding
* Quarterly access reviews ensure continued appropriateness
* Immediate access revocation upon offboarding

**Infrastructure Security**

* Enterprise-grade cloud infrastructure with built-in security features
* Isolated serverless environments prevent lateral movement
* Security monitoring and alert systems detect anomalous behavior

**Device Management**

* Mobile Device Management (MDM) vendor engaged (rollout: Q4 2025)
* Automated enforcement capabilities via PEO plus workspace SSO or OAuth (ETA: Q1 2026)
* Device-level security controls and compliance enforcement