Access Governance

Access Governance — Keystone Dataworks BizHub

Roles

Role	Tenant	Capabilities
`owner_admin`	keystone-owner	Full CRUD; branding; MFA required
`demo_viewer`	demo	Read-only synthetic data; shared password
`tenant_admin`	(future)	Full CRUD within one business tenant
`tenant_user`	(future)	Limited write within tenant

Account lifecycle

Onboarding (owner)

Run bizhub/scripts/create_first_user.py on the server for the first bootstrap account, or use Settings → Users after auth is enabled.
First login enrolls MFA at /mfa/setup.
Store backup codes offline.

Onboarding (additional companies)

Owner admin: Settings → Users → Create company — provisions tenant and shows a one-time invite link for the first admin.
Owner or tenant admin: Settings → Users → Invite user — copy invite link; invitee sets password at /invite/{token}.

Demo access

Single account (BIZHUB_DEMO_EMAIL) with BIZHUB_DEMO_SHARED_PASSWORD.
Rotate via bizhub/scripts/rotate_demo_password.py and update marketing copy.

Offboarding

Set is_active=false on app_users row (or delete after export).
Revoke sessions (restart app or change BIZHUB_SESSION_SECRET in emergency).
Document in audit log.

MFA policy

Required for owner_admin and tenant_admin when BIZHUB_REQUIRE_MFA=true.
TOTP (authenticator app) + one-time backup codes.
Demo viewers: password only (no sensitive data).

Quarterly access review checklist

[ ] List all app_users with is_active=true
[ ] Confirm each role matches job function
[ ] Confirm MFA enabled on privileged accounts
[ ] Rotate demo shared password if exposed
[ ] Review audit_log for anomalous actions
[ ] Confirm VPS SSH keys and sudo users

Emergency lockout

Set BIZHUB_OPEN_ACCESS=false (already default in production).
Change BIZHUB_SESSION_SECRET → invalidates all cookies.
Block nginx or stop keystonedataworks.service if breach suspected.

Template — review with legal counsel.

Privacy · Access governance · Incident response