> ## Documentation Index
> Fetch the complete documentation index at: https://help.avoca.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Identity and Access Controls

> Identity, access-management, and personnel safeguards used across Avoca.

# Identity and Access Controls

## Access Lifecycle

Access is provisioned according to role and business need, reviewed periodically, and removed when it is no longer required. Reviews cover privileged access, role appropriateness, service accounts, and exceptions to standard access patterns.

## Multi-Factor Authentication

Multi-factor authentication is required for administrative access to critical systems where supported. This includes infrastructure consoles, source-control administration, database administration, and security-sensitive SaaS applications.

## Least Privilege and Accountability

Avoca uses least-privilege principles throughout its environment:

* Individual accounts are preferred over shared credentials
* Elevated permissions are granted only when required
* Centralized identity and single sign-on are used where appropriate
* Service accounts and integration credentials are restricted and managed separately
* Access changes and privileged actions are logged where supported

## Application Authorization

Avoca applications use team- and role-based authorization to restrict access to customer data and administrative functions. Public API endpoints require the authentication mechanism documented for that endpoint, such as an API key, bearer token, or OAuth flow.

For API key types and scopes, see [Authentication and Permissions](/api-reference/authentication).

## Personnel and Device Controls

Personnel with access to Avoca systems are subject to security requirements appropriate to their role. Managed-device controls, security training, confidentiality obligations, and prompt offboarding support the technical access controls.

## Insider-Risk Safeguards

Avoca combines least privilege, access reviews, individual accountability, logging, environment separation, and offboarding procedures to reduce malicious and accidental insider risk.