Sign in and roles
How people sign in, how long a session lasts, and the roles on an organization.
Sign-in is email and password, or a supported single sign-on provider such as Google. Identity is handled centrally, separate from each firm's working environment.
Sessions
- Cookies are HttpOnly, Secure, and SameSite=Lax.
- A session lasts at most 8 hours.
- Account sessions end after 1 hour of inactivity.
Multi-factor authentication is planned for customer accounts. Today, sensitive actions require a recent sign-in. Destroying a workspace, rotating credentials, or changing a connected system's key all require a sign-in from the last 10 minutes.
Roles
Each organization has three roles: owner, admin, and member.
Every administrative request is checked against current membership. When you remove someone, their access to administrative operations ends on their next request.
Opening a workspace uses a signed, single-use handoff. It names the person, their role, and the one environment it is for. It expires within 60 seconds, and another environment will reject it.
The full access model is on the Security page.