# Access control policy

**Draft for review.** Not approved. Owner: `{{SECURITY_OWNER}}`. Last reviewed: `{{REVIEW_DATE}}`.

## Customer (clinic) access

- Organizations are invite-only. An owner or an admin invites people into named clinics with one of
  six roles (`packages/core/src/roles.ts`); only an owner can create another owner.
- Relief vets get access limited to named clinics and dates.
- Organizations can require two-step sign-in for owners and admins or for everyone, require single
  sign-on, limit roles per clinic, limit who may invite, and shorten sessions.
- Sensitive actions (billing, single sign-on and SCIM settings, the two-step requirement,
  organization deletion) need a two-step code entered within the last 15 minutes when the person
  has two-step sign-in.
- Owners and admins review access every quarter in Settings, Access reviews. The completed review
  is stored unchanged and can be exported as evidence. "Change" and "remove" decisions are carried
  out in Team within 10 working days.

## Veteros staff access

- Production access is limited to the people who operate the service, named by `{{SECURITY_OWNER}}`.
- Operator tasks run as scripts with the system role (`apps/v2/scripts`), never as ad hoc database
  sessions, and leave audit events.
- Staff accounts use two-step sign-in wherever the provider offers it (hosting, database, source
  control, billing provider, email provider).
- Access is removed on the day someone leaves; staff access is reviewed every quarter, with the same
  evidence as customer reviews.

## Credentials

- Passwords are stored as scrypt hashes; session, invitation, SCIM and challenge tokens only as
  SHA-256 hashes; secrets encrypted with the data key and not selectable by the request role.
- Secrets live in the environment of the host, never in the repository.