Access Control Policy
1. Purpose
Define who may access Fueling Agile systems and data, how access is granted, reviewed, and removed, and how the product enforces those rules.
2. Identity and authentication
- Users authenticate with a unique email and password.
- Passwords are stored using BCrypt. Plaintext passwords are never stored.
- Successful login issues short-lived access tokens and longer-lived refresh tokens tied to a server-side session.
- Sessions record security-relevant metadata and can be revoked.
- Failed login attempts trigger rate limiting and account lockout. Unlock follows password reset.
- Company accounts using a first-time password must change it before normal use. Shared default passwords are prohibited.
3. Authorization model
3.1 Platform staff (admin portal)
Access is granted by role and enforced by server-side policies (Ops, Security, Admin, SuperAdmin / GodAdmin). Sensitive mutations often require an approval request.
3.2 Customer users (company portal)
- Company users only access data for their own company.
- Where subsidiaries are used, access may be limited to the assigned subsidiary.
- Cross-company browsing by customer accounts is blocked by server-side scoping.
3.3 Infrastructure access
Production host and database access is limited to authorized operators. SSH, firewall, and CI/CD credentials follow the internal deploy SOP.
4. Account lifecycle
| Event | Required action |
|---|---|
| Join / role change | Grant least privilege; document business need |
| Leave / contractor end | Disable accounts same day; revoke sessions |
| Suspected compromise | Revoke sessions immediately; reset credentials; investigate |
| Periodic review | At least every 6 months, review admin roles and unused accounts |
5. Privileged access rules
- GodAdmin / SuperAdmin accounts are limited to people who need them.
- Viewing or exporting sensitive data must be justifiable and is subject to audit logging.
- Job dashboards remain locked down in production.
- Sharing admin passwords is forbidden. Use individual accounts only.
6. Customer responsibilities
- Keep passwords confidential and unique
- Report suspected unauthorized access promptly
- Limit who inside the organisation receives company-portal credentials
7. Enforcement (product)
- JWT and role policies on admin APIs
- Company / subsidiary scope checks on customer APIs
- Session revocation
- Login rate limit and lockout
- Approval workflow for designated high-risk admin actions
8. Known limitations
Until implemented, do not promise MFA / SSO, or a 24×7 security operations centre.