Security and Permissions

Security is one of the core design principles of Alius Agent Team. This chapter details the system’s security architecture, permission management mechanisms, and security best practices.

Security Architecture Overview

Alius Agent Team adopts a multi-layered security architecture:

┌─────────────────────────────────────────┐
│           Application Layer Security       │
│   Authentication / Session Management     │
│   / CSRF Protection                      │
└─────────────────┬───────────────────────┘
                  │
┌─────────────────▼───────────────────────┐
│           Authorization Layer Security     │
│   RBAC / Permission Check / Audit Log    │
└─────────────────┬───────────────────────┘
                  │
┌─────────────────▼───────────────────────┐
│           Data Layer Security             │
│   Encryption Storage / Transmission      │
│   Encryption / Data Isolation            │
└─────────────────┬───────────────────────┘
                  │
┌─────────────────▼───────────────────────┐
│           Infrastructure Security         │
│   Network Security / Host Security      │
│   / Patch Management                     │
└─────────────────────────────────────────┘

Authentication System

Supported Authentication Methods

Alius Agent Team supports multiple authentication methods to meet different user needs:

SMS Authentication

Authentication based on mobile phone number, suitable for most users.

Workflow:

User enters mobile phone number
System sends 6-digit verification code to phone
User enters verification code
System verifies verification code
Authentication successful, create session

Security Features:

Verification code valid for 5 minutes
Maximum 1 send per minute per number
Maximum 10 sends per day per number
Locked for 15 minutes after 5 consecutive input errors

Apple ID Authentication

Use Apple ID for authentication, providing fast and secure login experience.

Workflow:

User selects “Sign in with Apple”
System redirects to Apple authentication page
User enters Apple ID and password (or biometric)
Apple verifies and calls back
System creates or links account

Privacy Features:

Supports “Hide My Email” feature, Apple provides relay email
Does not leak unnecessary personal information to Alius
User can revoke authorization in Apple account at any time

WeChat Authentication

Use WeChat QR code scan for authentication, suitable for Chinese users.

Workflow:

User selects “WeChat Login”
System generates QR code
User scans QR code with WeChat
User confirms login in WeChat
System verifies and creates session

Security Features:

QR code valid for 2 minutes
QR code can only be used once
Supports WeChat’s risk control mechanisms

Multi-Factor Authentication (MFA)

To provide higher security, Alius Agent Team supports multi-factor authentication:

Enabling MFA

Go to User Settings > Security
Find “Multi-Factor Authentication”
Click “Setup”
Select MFA method:
- TOTP: Use apps like Google Authenticator, Authy
- SMS: Receive verification code via SMS
- Email: Receive verification code via email
Complete setup according to wizard
Save backup recovery codes

Using MFA

After enabling MFA, login flow becomes:

Enter username and password (or SMS verification code)
System prompts for MFA verification code
Enter TOTP verification code (or SMS/email verification code)
Authentication successful

Recovery Codes

When setting up MFA, the system provides a set of recovery codes:

Each recovery code can only be used once
Please keep recovery codes properly
If you lose recovery codes and cannot use MFA device, you need to contact support team

Session Management

Session Lifecycle

Access Token: Short-term valid (default 1 hour)
Refresh Token: Long-term valid (default 30 days)
Auto Refresh: Auto refresh before access token expires
Active Logout: Immediately invalidated when user actively logs out

Session Security Policies

Single Device Login: Optional, same account can only login on one device
Session Timeout: Auto logout after 7 days of inactivity
Anomaly Detection: Require re-authentication when abnormal login location detected
Concurrency Control: Limit number of concurrent sessions for same account

Session Management Operations

Users can view and manage their active sessions:

Go to User Settings > Security > Active Sessions
View all active sessions:
- Device type
- Geographic location
- Last activity time
- IP address
Can select “Logout All Other Sessions”

Authorization and Permission Management

Role-Based Access Control (RBAC)

Alius Agent Team adopts RBAC model for permission management:

User -> Role -> Permission -> Resource

Role Hierarchy

Owner
  └── Admin
       └── Member
            └── Viewer

Built-in Roles

The system provides the following built-in roles:

Role	Description	Applicable Scenario
Owner	Full control	Team creator
Admin	Management permissions	Team administrator
Member	Standard permissions	Team member
Viewer	Read-only permissions	Observer, auditor

Permission Model

Resource Types

System permission control is applied to the following resource types:

Agent: AI Agent entity
Task: Task entity
Team: Team entity
User: User entity
Notification: Notification entity
Session: Session entity

Operation Types

For each resource, the following operations are supported:

create: Create new resource
read: View resource
update: Modify resource
delete: Delete resource
list: List resources
execute: Execute resource-related operations

Permission Check Flow

User Request Operation
    ↓
Check if user is authenticated
    ↓
Check if user has permission for this operation
    ↓
Check resource-level permissions (e.g., resource ownership)
    ↓
Allow or deny operation

Fine-Grained Permission Control

In addition to role-based permissions, Alius Agent Team also supports resource-level permission control:

Agent Permissions

Private Agent: Only creator can access
Team Agent: Team members access according to role
Public Agent: Any authorized user can access (read-only)

Task Permissions

Creator Permission: Task creator has full control
Executor Permission: Agent owner assigned to execute task can view
Team Task: Team members access according to role

Data Permissions

Row-Level Security: Users can only access data rows they have permission to access
Field-Level Security (Planned): Users can only view fields they have permission to view

Custom Roles

In addition to built-in roles, team Owners and Admins can create custom roles:

Creating Custom Role

Go to Team Settings > Permission Management
Click “Create Role”
Enter role name and description
Select permissions this role has:
- Filter by resource type
- Filter by operation type
- Batch select or select individually
Save role

Custom Role Example

Agent Reviewer:

Can view all Agents
Can view Agent logs
Cannot modify Agent configuration
Cannot create or delete Agents

Task Assigner:

Can view all tasks
Can create and assign tasks
Cannot execute tasks
Cannot modify Agent configuration

Data Security

Data Encryption

Transmission Encryption

TLS 1.3: All communication between client and server uses TLS 1.3 encryption
Certificate Pinning: Mobile apps use certificate pinning to prevent man-in-the-middle attacks
Strong Cipher Suites: Only use strong cipher suites, disable weak encryption algorithms

Storage Encryption

Static Data Encryption: All data stored on servers is encrypted using AES-256
Key Management: Encryption keys are managed using dedicated key management system
Database Encryption: Sensitive fields (e.g., passwords, tokens) are individually encrypted in database

Data Isolation

Multi-Tenant Isolation

Logical Isolation: Data from different teams is completely isolated at the logical level
Resource Isolation: Agents from different teams run in isolated environments
Cache Isolation: Cache data is isolated by team

User Data Isolation

Users can only access data they have permission to access
Implemented through row-level security policies
Regularly audit data access logs

Data Backup and Recovery

Backup Strategy

Full Backup: Once a week
Incremental Backup: Once a day
Real-Time Replication: Critical data replicated to backup data center in real-time
Offsite Backup: Backup data stored in different geographic locations

Recovery Strategy

RTO (Recovery Time Objective): 4 hours
RPO (Recovery Point Objective): 1 hour
Recovery Testing: Conduct recovery testing quarterly
Recovery Process: Detailed disaster recovery process documentation

Audit and Compliance

Audit Logs

Alius Agent Team records audit logs for all critical operations:

Recorded Operations

User login/logout
Agent creation/modification/deletion
Task creation/modification/deletion
Team member changes
Permission changes
Sensitive configuration changes
Data export operations

Log Content

Each audit log records the following information:

Timestamp: Precise time when operation occurred
User Identifier: User who performed the operation
Operation Type: What operation was performed
Resource Type: Type of object operated on
Resource Identifier: Specific object operated on
Operation Result: Success or failure
IP Address: IP address from which operation was initiated
User Agent: Client information used

Log Retention

Online Query: Logs from last 90 days can be queried online
Archive Storage: Logs after 90 days are archived and retained for 7 years
Immutable: Once audit logs are written, they cannot be modified or deleted

Compliance

Data Protection Regulations

Alius Agent Team is committed to complying with major data protection regulations:

GDPR (EU General Data Protection Regulation)
CCPA (California Consumer Privacy Act)
PIPL (Personal Information Protection Law of PRC)

Compliance Features

Data Subject Rights:
- Right to know: Clearly inform what data is collected and how it’s used
- Right to access: Users can access their personal data
- Right to rectification: Users can correct inaccurate data
- Right to erasure (right to be forgotten): Users can request deletion of their data
- Right to data portability: Users can export their data
- Right to restrict processing: Users can restrict processing of their data
Data Protection Officer: Appoint data protection officer responsible for compliance affairs
Data Protection Impact Assessment: Conduct DPIA regularly
Breach Notification: Notify regulatory authorities and users according to regulations when data breach occurs

Security Certifications

Alius Agent Team has obtained the following security certifications:

ISO 27001: Information security management system certification
SOC 2 Type II: System and organization controls audit
CSA STAR: Cloud Security Alliance Security, Trust, and Assurance certification

Security Best Practices

For Users

Account Security

Use Strong Password: At least 12 characters, including uppercase and lowercase letters, numbers, and special characters
Enable MFA: Add extra security layer to account
Change Password Regularly: Recommended to change every 3-6 months
Don’t Use Public Devices to Login: Avoid logging in on public computers
Clean Up Sessions When Logging Out: Logout on public devices when done

Access Control

Follow Least Privilege Principle: Only grant necessary permissions
Review Permissions Regularly: Review your own and team’s permissions quarterly
Revoke Permissions Promptly: Revoke access permissions promptly when members leave
Use Teams Instead of Shared Accounts: Avoid using shared accounts, use team features

Data Protection

Don’t Share Sensitive Information: Avoid including sensitive information in prompts
Export and Backup Regularly: Export important data regularly
Be Cautious with Third-Party Integrations: Only integrate with trusted third-party services
Monitor Abnormal Activities: Pay attention to account activity notifications

For Team Administrators

Team Security Policy

Establish Security Policy: Establish clear security policy for the team
Conduct Security Training Regularly: Provide security training to team members
Establish Incident Response Process: Develop security incident response process
Conduct Security Audits Regularly: Conduct security audit quarterly

Permission Management

Implement Role Separation: Use different roles for different responsibilities
Review Member List Regularly: Remove inactive or unnecessary members promptly
Limit Number of Administrators: Only give administrator permissions to necessary people
Use Expiration Policy: Set expiration for temporary permissions

Vulnerability Reporting and Handling

Reporting Security Vulnerabilities

If you discover a security vulnerability, please report it through the following methods:

Email: security@alius.ai
PGP Public Key: Download PGP Public Key
Bug Bounty Program: For eligible vulnerability reports, we will provide rewards

Vulnerability Handling Process

Receive Report: Security team receives vulnerability report
Confirm Vulnerability: Verify authenticity and severity of vulnerability
Fix Vulnerability: Development team fixes vulnerability
Release Update: Release security update
Public Disclosure: Publicly disclose vulnerability after fix (optional)

Security Updates

Critical Vulnerabilities: Patch released within 24 hours
High-Risk Vulnerabilities: Patch released within 7 days
Medium-Risk Vulnerabilities: Patch released within 30 days
Low-Risk Vulnerabilities: Fixed in next regular release

API Security

API Authentication

API Key

Generate Key: Generate API key in user settings
Key Permissions: Can set specific permissions for key
Key Rotation: Recommended to rotate API keys regularly
Key Compromise Handling: Revoke immediately if key compromise is discovered

OAuth 2.0

Alius Agent Team supports OAuth 2.0 authorization framework:

Authorization Code Flow: Suitable for server-side applications
Implicit Flow: Suitable for pure frontend applications (not recommended)
Client Credentials Flow: Suitable for inter-service communication
Refresh Token: Use refresh token to obtain new access token

API Security Best Practices

Use HTTPS: All API calls must use HTTPS
Validate Input: Always validate and sanitize input data
Rate Limiting: Implement rate limiting to prevent abuse
Use Least Privilege: Only grant necessary permissions to API keys
Monitor API Usage: Monitor abnormal API call patterns

Summary

Security is an ongoing process, not a one-time task. Alius Agent Team is committed to providing secure and reliable services, but also needs user cooperation. By following the security best practices in this document, you can maximize the protection of your account and data security.

If you have any security questions or concerns, please contact our security team at: security@alius.ai