Security at MonSPHERE: RBAC, MFA, and Append-Only Audit Logs
A look at the real security controls behind MonSPHERE's enterprise foundation.
Security claims are easy to make and hard to verify from the outside. Here's what's actually built into MonSPHERE today, not what's aspirational.
Access control
RBAC is permission-based, not just role-name-based — every role, including custom ones organizations compose themselves, is built from a real 12-key permission catalog (org:manage, audit:read, monitors:manage, and so on). There's no "admin can do everything, everyone else can do nothing" fallback.
Multi-factor authentication
MFA is real RFC 6238 TOTP — the same standard used by Google Authenticator and most enterprise identity tools — with single-use backup codes for account recovery, not a mocked toggle in a settings page.
Audit logging
Every configuration change writes an append-only audit_logs row. "Append-only" isn't just a convention here — a database trigger rejects any UPDATE or DELETE against that table outright, so even a compromised admin credential can't quietly edit the trail after the fact.
Data isolation
Every resource belongs to exactly one organization, enforced at the query layer across every service — the same isolation model that makes multi-tenant MSP deployments safe is the same isolation protecting a single enterprise's own internal environments from each other.
Where we're honest about gaps
SAML/LDAP SSO is in progress, not finished — the underlying provider data model exists, the full login flow doesn't yet. We'd rather list it under Roadmap than imply it's done.