Identity & Access›Roles & Permissions

Policies (ABAC)

Tenant-wide security policy. Applies to every login, every session, every API call against this tenant.

Network policy
IP allowlist takes precedence: if non-empty, only matching CIDRs may sign in. Denylist always blocks.

Empty = allow from anywhere (subject to denylist).

Password policy
Enforced at signup, password change, and password reset.
Session policy
Affects new sessions only; existing sessions keep their original lifetime.

Go duration string. Examples: 24h, 720h (30 days), 2160h (90 days).

MFA enforcement
How aggressively users are pushed toward enrolling a second factor.

Step-up enforcement on login lands in P1-7 (see GAP-ANALYSIS).

Unsaved changes

Platform
Identity & Access
Authentication
Security & Compliance
Developer
Settings
↑↓ navigate · ↵ select · esc close59 results