Security
A project's security rests on four levers: people's roles, credentials referenced by name and never exposed, least privilege on ports, and each channel's access control.
A sensitive value never goes back to the browser: writing it replaces it, nobody can read it again.
Each agent receives only the ports it needs.
Login can go through the company directory (Microsoft Entra ID).
Organizations, roles and groups
A person can belong to several organizations. In Organization → Members each member has a role, groups and, if needed, a linked Telegram identity.
| Role | What it can do |
|---|---|
| user | Chats with the allowed agents and opens the organization's apps |
| fullmember | Also builds: projects, code, data |
| admin | Also manages the organization's settings, members, secrets and connections |
Groups restrict agents, web apps, bots, mailboxes and skill libraries to a subset of members.
Secrets and connections
| Reference | Meaning |
|---|---|
| Organization secret | Set by an administrator in Organization → Secrets and referenced by name |
| Personal secret | Set by each member from their own profile; used when the call is made on behalf of that member |
| OAuth connection | An OAuth application registered once (Microsoft 365, Google, a CRM); the token is renewed by the platform |
- A connection can be linked by the administrator for the whole organization, or by each member for themselves.
- The Secrets table shows, for each name, its status, who set it and which node requires it.
- Variables are not credentials: they hold non-secret state that nodes read and write.
Sign-in with the company identity
Organization → Identity enables login through the company directory; Microsoft Entra ID is available today. Anyone with an account in the tenant and an email from one of the configured domains signs in with a button, without a TeraBrain NX password.
- Tenant. The tenant identifier is verified at every sign-in.
- Auto Join. The person becomes a member on first sign-in, with the indicated role.
- Group Mappings. Directory groups become roles and labels.
- Sync. Periodic reading of the directory (every 60 minutes by default). Remove Leavers removes anyone no longer in the mapped groups, never members added by hand nor the last administrator.
Least privilege: the checklist
- Public agents: no full database access, no file writing, no development tools, no sandbox or on-premise machines.
- On ports that send outside (email recipients, callable numbers, transfers) use
allowto limit where they can go. - Web apps with company data:
organizationorgroupaccess, neverpublic. - Treat the MCP server address like a password; rotate it by changing the key.
- Public file links only where needed, with a short expiry.
- Credentials never in the code: declared in the node's Secrets and read at runtime.
Related pages
Governance and audit
Versions, rollback, activity log and tracing of every conversation: knowing what agents do.
Channels: how people reach agents
Web app, Telegram, mailbox, phone, scheduler and MCP server: how they connect and how you control who can use them.
Data and knowledge
MySQL databases, file storage and skill library: the persistent state of agents and code.
Have an agent to take to production?Let’s talk.
We show you TeraBrain NX on your case: systems to connect, access and controls.