Roles, sign-in security and the audit log

Who can see what, how sign-ins are protected, and what is recorded.

Account & security 2 min read Article 2 of 6 in Account & security

Roles

What somebody can see is set by their role, and a role can be narrowed further — to their own consultants, or to the ones assigned to them. One customer's records are never returned to another, whatever a role says.

Sign-in

Multi-factor sign-in can be required for your account. Passwords are changed from Settings, and a session signed out elsewhere does not sign out the tab you are working in.

The audit log

Who did what, to what, from where, and whether it worked. Permission changes, impersonation, consent and access to restricted documents are always recorded — that part cannot be switched off, because a log that can be is not evidence of anything.

The log is tamper-evident: each record is chained to the one before it, so an edited or removed row can be detected rather than assumed impossible.

The MetaOpus audit log, showing a recorded action with who did it, when, its severity and its outcome. — Who did what, when, and whether it worked — with a Verify integrity button that checks the chain. Tap to enlarge.

Frequently asked

Can the audit log be switched off?

No. Permission changes, impersonation, consent and access to restricted documents are always recorded. A log that can be switched off is not evidence of anything.

What does tamper-evident actually mean here?

Each record is chained to the one before it, so an edited or removed row can be detected rather than merely assumed impossible. The console has a Verify integrity control that checks the chain.

Can one customer's records reach another?

No. Whatever a role says, records are separated by customer — a role can narrow what somebody sees within your account, never widen it beyond it.

Was this helpful?