Security & Reliability
A cross-page summary of EM-OS's access control, auditing, and reliability (SLO) capabilities, gathered from the individual manual pages. See the linked sections for full details.
This page summarizes sections that already exist elsewhere in the manual. For certification status or contract terms not covered here, please contact your organization's administrator or your account representative.
Access Control (RBAC)
Access is controlled through three roles based on the principle of least privilege.
| Role | Key Permissions |
|---|---|
| Org Admin | Organization-wide settings, member invitations, full data access/edit |
| Lead (Manager) | Manage team members, 1on1s, ADR approval, evaluations, skill update approval |
| Member (General User) | Update own profile, participate in 1on1s, view data (excluding private settings) |
Details: Administration > Permission Management (RBAC)
Audit Logs
Records "who did what and when" across the following categories:
- Authentication: Logins, logouts, and failed attempts
- Organization: Team creation/deletion, role changes, and invitation issuance
- Management: Subscription plan changes and system setting updates
- Data: Deletion of ADRs and operations on sensitive artifacts
Details: Administration > Audit Logs
Visibility of Sensitive Data
Financial information such as salaries and unit rates can be restricted via the financial_visibility system setting, which also governs cost visibility in Man-hour Analysis.
Details: Administration > System Settings
Payment Handling
Subscription billing runs through Stripe integration, covering card registration, billing history, and plan upgrades.
Details: Administration > Subscription Management
Scope of External Integrations
| Provider | What's shared |
|---|---|
| GitHub | Four Keys metrics, issue/backlog sync, user profile sync |
| Slack | Alert notifications, approval flow notifications (skill updates, ADRs, etc.) |
Details: Administration > External Integrations
Reliability (SLO Management)
System reliability is quantitatively managed through three concepts:
- SLI (Service Level Indicator): The metric being measured (e.g., % of API latency < 300ms)
- SLO (Service Level Objective): The target value for the SLI (e.g., 99.9%)
- Error Budget: The margin against the target, used to decide between investing in innovation or reliability improvements
Details: Technical Management > Service Level Objectives (SLO Management)
Incident Response
Major incidents or SLO breaches are handled through the post-mortem process.
- Root Cause Analysis (RCA): 5 Whys to identify structural issues
- Timeline Logging: Accurate record from occurrence through detection, response, and recovery
- Action Item Sync: Prevention tasks are registered as Technical Debt and tracked to completion
- Blameless Culture: Focus on fixing systemic weaknesses, not assigning individual blame
Details: Technical Management > Post-mortems