Identity and authentication
All human and machine identities are issued by Logto (OAuth2 / OIDC). Every API request carries a token the backend verifies on ingress.
Multi-factor authentication — TOTP authenticator apps, WebAuthn /
passkeys, and backup codes are supported and offered at sign-in.
Whether MFA is required is a deployment policy decision.
Password policy — minimum length, breached-password rejection
(haveibeenpwned), and repetition / personal-info checks are enforced
at the identity provider.
Federated login (SSO) — sign-in is first-party by default;
enterprise SSO (SAML / OIDC) can be configured at the identity
provider per deployment. Contact us for SSO onboarding.
API keys
For server-to-server access, AICO issues self-contained signed API keys:- Signed tokens carrying the organization, granted scopes, and optional expiry — verified without a database read.
- Rotation is a single call: the old key is revoked and a new one returned (shown once).
- Revocation takes effect within 30 seconds across all backend instances.
- An API key is always organization-scoped and can never escalate to operator privileges.
- Every create / update / rotate / revoke is written to the audit log.
Role model
Organization roles
Deliberate separations worth knowing for a review:
- Admin is not Owner: provider secrets, API keys, integrations, and billing are Owner-only.
- Supervisor can monitor and control live calls but cannot modify flows.
- Booking Manager is siloed to booking data — no flow or telephony access.
Host role
Super Admin is host-level — held by the deployment operator, not
by tenant users. Tenant administrators are Owners, not super
admins.
Scope enforcement
- Route policies are mandatory — every route declares the scopes and organization permissions it requires. A route without a policy is caught at startup, not in production.
- Wildcard matching —
flows:*grants everyflows:scope. - Super admin bypass — scope checks short-circuit for the host role only.
Tenant isolation
Every multi-tenant entity is scoped by an organization ID, enforced on every read and write at the application layer; the tenant context is derived from the verified token and the active organization at request ingress. Organization-scoped tokens are the only tokens accepted on organization APIs. As defense in depth, row-level security policies are provisioned on tenant tables at the database layer; the application layer is the primary enforcement boundary. Cross-tenant access requires the host-level Super Admin role.Anonymous web tier
The public widget endpoints are a separate, deliberately narrow surface:- Disabled by default — each flow must explicitly enable web access.
- Requests are validated against the flow’s origin allowlist.
- Rate limits apply per visitor session and per IP.
- No organization data is reachable: the anonymous tier can only converse with the enabled flow.
- Optional signed identity: your backend vouches for a visitor with an HMAC-signed token; AICO verifies it against a per-organization secret.
Audit and retention
- Audit log — administrative actions (organization settings, provider secrets, API keys, datasets, notifications) are recorded as structured audit events, queryable per organization with actor, action, resource, and time filters.
- Call history — every session’s metadata, variable state, tool calls, and final status is persisted and queryable through the monitoring API.
- Session recordings — opt-in per flow (off by default), decided flow-over-organization-over-instance. Audio-only output to the instance’s recording volume or S3-compatible object storage. Playback URLs are short-lived and signed.
- Flow versioning — every save appends an immutable version snapshot; rollbacks create new versions rather than rewriting history.
- Transcripts and memory — persisted in the primary database; retention windows are deployment policy.