Security & Access Control

Enterprise-Grade
Security & Access Control

Role-based access control, KMS-backed secrets management, approval workflows, and comprehensive audit trails. Every action on the platform is permissioned, encrypted, and logged.

Role-Based Access Control

MechaMental implements a layered RBAC system that operates at both the organization and workspace levels. Define exactly who can do what, down to individual permission combinations.

Organization-Level Roles

Broad roles that govern platform-wide access and administration.

  • Organization owner and admin roles
  • Member invitation and management
  • Billing and subscription control
  • Cross-workspace policy enforcement

Workspace-Level Roles

Fine-grained roles scoped to individual workspaces and their resources.

  • Workspace admin, editor, and viewer roles
  • Custom role definitions with granular permissions
  • Policy-based access control rules
  • Member management with role assignments

Vault — Secrets Management

KMS-backed secret storage for API keys, tokens, credentials, and sensitive configuration. Secrets are encrypted at rest, versioned, and audited on every access. Provider accounts use the vault to store model API credentials.

Multiple Secret Types

API tokens, credential pairs, certificates, SSH keys, JSON blobs, and environment files.

KMS-Backed Encryption

All secrets are encrypted at rest using KMS. Decryption requires authenticated access.

Version & Rotation History

Every secret update is tracked as a new version. Full rotation history is preserved.

Rotation Reminders

Configure expiry dates and rotation reminders to ensure credentials stay fresh.

Access Count Monitoring

Track how many times each secret has been accessed and by which services.

Provider Account Integration

Provider accounts reference vault secrets for model API credentials automatically.

Approval Workflows

Multi-level approval gates for sensitive operations like production deployments. Configure who approves, how many approvals are needed, and under what conditions approvals are required.

Configurable Approvers

Designate specific roles or users who can approve sensitive operations.

Multi-Level Gates

Require multiple approvals before deployments or configuration changes proceed.

Conditional Rules

Define conditions that trigger approval requirements based on environment, scope, or risk.

Audit Logs

Comprehensive activity logging across the entire platform. Every API call, configuration change, and deployment is recorded with timestamps, actors, and full details for compliance and troubleshooting.

Every API call logged with request details
Configuration changes tracked with before/after state
Deployment events with actor and timestamp
Secret access and modification audit trail
Role and permission change history
Searchable and filterable log interface

Billing & Limits

Control costs and resource usage with workspace quotas, rate limits, and throughput limits. Set on-demand budgets and track usage per workspace to prevent runaway spending.

Rate & Throughput Limits

Set requests-per-minute and throughput ceilings per workspace to control resource consumption.

On-Demand Budgets

Configure spending budgets per workspace with alerts when approaching limits.

Usage Tracking

Monitor token usage, API calls, and compute spend per workspace with detailed breakdowns.

Workspace Quotas

Enforce hard limits on the number of apps, models, secrets, and other resources per workspace.

Security built into every layer

From RBAC to encrypted secrets to audit logs, MechaMental ensures your AI operations meet enterprise security and compliance requirements.

Explore the Platform