This platform holds credentials for equipment that keeps facilities alive and can issue commands to it. Every design decision below follows from that.
Every entity in the system, user, role, asset, location, alarm rule, escalation policy, API key, belongs to an account. Visibility is resolved by recursive traversal of the account tree inside the repository layer, so there is no application-level filter to forget, misconfigure or bypass.
Nesting depth is unlimited. A read scoped to Customer A returns Chicago and Dallas and nothing above or beside them.
Assets, locations, users, roles, alarm rules, escalation policies and API keys all carry an account. There is no global object a tenant can reach by accident.
Subtree visibility is computed by recursive query in the repository, which means the boundary holds for the API, the UI, an export and a background job identically.
Super-root operators administer every account without holding membership in any, and only they may upload protocol packs.
The selected account scope persists across every page, so an operator working a tenant incident is not repeatedly re-filtering the world.
Building, floor, room, row, rack and slot form a per-account tree; an asset's account is inherited from where it physically sits, not from who imported it.
| Default role | Grants |
|---|---|
| Admin | Full access within the account subtree, including users, roles and catalog |
| Operator | Asset and event management, command execution, simulator control |
| Viewer | Read-only across the account subtree |
Roles are definable per account with granular create, read, update and delete permissions per object type, asset, user, account, alarm, event, subscription, simulator and catalog. The defaults are a starting point, not the ceiling.
Device credentials are stored encrypted at rest. Redfish sessions are managed and refreshed by the platform; MQTT broker credentials are held encrypted per asset. Operators never need the device password to run a command.
Microsoft Entra ID, Google, GitHub or any compliant OIDC provider, alongside local credentials, no separate identity integration project.
Provisioned with an expiry and revocable individually, so automation inherits a person's scope and can be withdrawn without touching them.
Eight-hour session lifetime with secure cookie flags over TLS, and session activity written to the audit record.
Twenty failed attempts per IP and ten per user in a fifteen-minute window before lockout, counted centrally with graceful degradation if the counter store is unavailable.
Every write operation records a before and after diff, the actor, the timestamp and the source IP. Retention is indefinite, and there is a dedicated viewer in the admin interface rather than a log file someone has to be granted access to.
Each acknowledgement, shelve and clear is attributed and timestamped on the alarm record. "Who silenced this, when, and on what basis" is a question with an answer.
Control operations against devices are logged with the same fidelity as configuration changes, the difference between an incident review and an argument.
A bulletin library maintained at the platform tier matches automatically against assets by manufacturer and model, so an advisory arrives attached to the list of your equipment it affects rather than as a mail to interpret.
Telemetry retention is configurable and size-bounded, pruned in chunks with a row-level fallback at the boundary. Event retention is configurable independently. Audit history is kept regardless.
Rate limiting, IP policy, JWT validation and TLS termination in front of every northbound route.
Outbound webhooks are HMAC-signed; inbound Redfish event callbacks are validated the same way.
On-premises or your own cloud account. No mandatory vendor cloud, no telemetry egress requirement.
Structured JSON logs shipped to an aggregation stack with provisioned dashboards, so platform behaviour is inspectable.
We are happy to walk your security team through the tenancy enforcement model, the credential storage design and the audit schema directly. That conversation tends to be shorter and more useful than a questionnaire.