Scoped keys.
Keys limited by environment, object and action.
PERMISSIONS & AUDIT
Every read and write, scoped and on the record.
Scope every connection, API key and agent to the objects and actions it needs. Every read and write lands in an audit log you can search and export.
Least privilege, by default.
Connection scopes.
Request only the platform permissions your product uses.
Roles for your team.
Owner, admin, developer, support and read-only roles in the dashboard.
Agent policies.
Allow-lists, amount limits and approval rules for every agent.
Audit log.
Actor, action, object, before and after, platform response, timestamp.
Export.
Stream audit events to your SIEM or download CSV.
HOW IT WORKS
Grant, act, record.
Grant.
Give each key, connection or agent the objects and actions it needs, nothing more.
Act.
Every call is checked against its scope before it reaches the platform.
Record.
The actor, the change and the platform response land in the audit log.
Permissions and audit questions.
How long are audit logs kept?
Retention depends on plan. The current retention for each plan is listed on the pricing page.
Is the log tamper-evident?
Entries are append-only and hash-chained.
Do you support SSO and SCIM?
SSO on Scale and Enterprise; SCIM on Enterprise.
Can support staff see customer data?
Only with a time-limited access grant you approve, and that access is itself logged.