Security & access
How access works
Login is GFAVIP Wallet SSO only. No passwords. Tokens are validated on every request, so a revoked grant takes effect on the next call rather than when a cached session expires.
Three roles
Any valid GFAVIP identity may sign in. A new non-staff user lands as client with no domain grants. They are authenticated but see nothing until an admin grants domains.
| Role | Sees |
|---|---|
| admin | Everything, all domains, plus writes, sync, and spend |
| member | Everything read-only, across all domains. For internal staff. |
| client | Only the domains explicitly granted to them |
SSO fails closed
Any error in identity validation fails closed. Identity is never read from the URL.
Domain grants
Clients only see domains an admin grants. Agents use the same grant model as people.
Hidden from agents
User management, credentials, deletion, and direct database access are not on the MCP surface.
Worker isolation
A dedicated worker owns the scheduler so long syncs cannot steal web request slots.
Job safety
Postgres advisory locks so each job fires once even with several processes running.
Server-rendered console
No SPA framework. Migrations apply on boot. Health check at /healthz.
Request access to RankingSolution
We run the portfolio operations. You get a console scoped to your own domains, covering DNS, infrastructure, search performance, and the SEO work that comes off it. Pricing is worked out on a call.