Radically secure. Radically simple.
A central super-user with a locally rebuilt permission matrix is explicitly not the target model. Microtech stays the authority over business data and user rights – SuperBRAIN adds an additional, verifiable governance layer.
The authorization formula
Microtech permission ∩ platform policy ∩ customer policy ∩ MCP scopes ∩ approval
Only when all five conditions are satisfied at once does any action become visible or executable – regardless of which channel the request came from.
Four strictly separated identity types
No identity implicitly inherits another's rights.
Interactive web identities
Login to the Cortex control plane – password hashing, encrypted TOTP/2FA, secure session cookies.
MCP service identities
OIDC/OAuth Client Credentials for AI clients and automations, with rotatable secrets.
ERP identities
Microtech users, bound via explicit identity links – never implicitly inherited.
Customer / self-service identities
External portal or website users, verified via magic link, OTP, passkey, or MFA.
Two separate OAuth resource servers
BVP MCP resource server
Authenticates AI clients and automations against the platform itself.
Microtech GraphQL resource server
Authenticates the actual ERP user and enforces Microtech's own permissions on every call. An MCP token is never forwarded as a Microtech token.
Risk classes for write operations
Writes are graded by criticality – not everything is equally risky, so not everything is treated the same.
| Class | Examples | Rule |
|---|---|---|
| R0 | Reading & introspection | No approval required |
| R1 | Draft, non-critical create | Per customer policy |
| R2 | Change master data, create document | Explicit approval required |
| R3 | Post, cancel, convert, archive | Approval always by a different person |
| R4 | Bulk change, deletion | Disabled by default |
Tenant isolation
PostgreSQL row-level security protects every tenant in addition to the application layer. The security context is set per transaction and never reused across pooled connections – missing context means automatic access denial.
Secrets & audit
ERP passwords and OAuth secrets never live in plaintext in the database – only encrypted references. Every relevant action is tenant-scoped, traceable, and auditable.