# Authentication & Multi-Tenancy

## Authentication Methods

- **OAuth2 Authorization Code (PKCE)** — Browser-based apps
- **OAuth2 Client Credentials** — Server-to-server
- **OAuth2 Device Code** — CLI and headless environments
- **Automatic token refresh** — Transparent renewal with refresh tokens

## Access Control

- **Scope-based permissions** — ReadWrite.All, User.Read, Architect.ReadWrite.All, AI.ReadWrite.All, MCP.Connect, and more
- **Tenant isolation** — Enforced data separation between tenants on every query
- **Role-based access** — Roles with granular permission sets
- **Record-level ACL** — Per-record ownership and sharing rules (private, read-only, read/update, full access)
- **Field-level ACL** — Restrict visibility or editability of individual fields per role

## User Management

- User signup with email verification, profile management, avatar, preferences
- Password change/reset, email change workflows
- Multi-device support with device registration for push notifications
- Per-user AI feature access control

## Multi-Tenancy

- Fully isolated data per tenant
- Multiple apps per tenant, each with scoped data sources
- Tenant-specific configurations, branding, and translations
- Organizational hierarchy with teams, roles, and user scoping

## Portal System

- Client portal configuration with dedicated portal users, organizations, roles, and sessions
- Separate authentication and access control for external users
