Access & Session Management

Beacon’s Access & Session Management module governs how users authenticate, what they are permitted to do, and how their sessions are controlled. It ensures that database observability data — which can be sensitive — is available only to authorized users operating within defined boundaries.

This module answers the question: “Who can access Beacon, what can they do, and how is their activity controlled?”

Capabilities

1. Authentication

Beacon provides secure authentication to protect platform access.

Capability	Description
Secure Sign-In	Users authenticate with credentials before accessing the platform.
Sign-Out	Users can end their session at any time.
Credential Protection	Authentication secrets are never exposed in the interface or logs.
Failed Attempt Handling	Repeated failed sign-ins are tracked and can be rate-limited.
Session Persistence Options	Configurable session lifetimes and renewal behavior.

Operational value: Establishes a trusted boundary around who can see and act on database observability data.

2. Role-Based Access Control

Beacon enforces access permissions through defined roles.

Role Concept	Description
Role Definitions	Named sets of permissions describing what a user can do.
Role Assignment	Users are assigned one or more roles.
Permission Scoping	Permissions can be limited to specific instances or features.
Least Privilege	Users receive only the access required for their responsibilities.
Role Review	Administrators can review and adjust role assignments.

Operational value: Ensures that sensitive capabilities — such as running queries or changing alert rules — are restricted to appropriate users.

3. Permission Granularity

Beacon controls access at a fine-grained level across modules and actions.

Permission Area	Example Control
Monitoring Views	Who can view monitoring dashboards.
Query Analysis	Who can access query performance data.
Execution Plans	Who can view and capture execution plans.
Schema Explorer	Who can browse schema and relationships.
SQL Playground	Who can execute queries and with what safeguards.
Alert Management	Who can create, modify, or acknowledge alerts.
Reports	Who can generate, view, and export reports.
Instance Management	Who can register or remove database connections.
User Management	Who can invite, modify, or deactivate users.

Operational value: Allows organizations to align platform access with real-world responsibilities and policies.

4. Instance-Level Access Scoping

Beacon allows access to be scoped to specific database instances.

Capability	Description
Per-Instance Permissions	Users may be granted access to some instances but not others.
Group-Based Scoping	Access granted through membership in defined groups.
Environment Separation	Distinguish production, staging, and development access.
Read-Only Access	Grant visibility without the ability to execute queries.

Operational value: Enables safe sharing of observability across teams without exposing every database to every user.

5. Connection Credential Management

Beacon manages the credentials used to connect to monitored databases.

Capability	Description
Credential Storage	Database connection credentials are stored securely.
Credential Encryption	Sensitive values are protected at rest and in transit.
Credential Masking	Secrets are never displayed in full within the interface.
Credential Rotation	Credentials can be updated without disrupting monitoring.
Access to Credentials	Only authorized components and roles can use stored credentials.

Operational value: Protects the keys to monitored databases while enabling continuous monitoring.

6. Session Management

Beacon tracks and controls active user sessions.

Signal	Description
Active Sessions	All currently signed-in users.
Session Start Time	When each session began.
Last Activity	Most recent action within a session.
Session Origin	Where the session originated, where available.
Session Termination	Administrators can end sessions when necessary.
Idle Timeout	Sessions inactive beyond a threshold may expire.

Operational value: Provides visibility and control over who is currently using the platform.

7. User Profile Management

Beacon allows users to manage their own account details.

Capability	Description
Profile Information	View and update personal account details.
Password Management	Change credentials through a secure process.
Notification Preferences	Control which alerts and reports are received.
Display Preferences	Personalize interface settings.

Operational value: Reduces administrative overhead by letting users manage routine account tasks themselves.

8. User Administration

Beacon provides administrative controls for managing the user base.

Capability	Description
User Invitation	Add new users to the platform.
User Deactivation	Disable access without deleting records.
Role Changes	Adjust a user’s roles and permissions.
Access Review	Audit who has access to what.
Activity History	Review user actions for accountability.

Operational value: Supports governance and keeps platform access aligned with team changes.

9. Access Auditing

Beacon maintains records of access-related events.

Signal	Description
Sign-In History	Successful and failed authentication attempts.
Permission Changes	When roles or scopes were modified.
Sensitive Actions	Query execution, report export, configuration changes.
Administrative Actions	User and instance management events.
Audit Retention	Configurable retention of access records.

Operational value: Provides traceability for security review and compliance needs.

Management Views

Profile View

Personal account and preference management.

User Administration

Manage users, roles, and access scopes.

Active Sessions

View and control currently active sessions.

Access Audit Log

Browse historical access and permission events.

Configuration Options

Option	Purpose
Session Lifetime	Maximum duration of a session.
Idle Timeout	Inactivity period before session expiry.
Password Policy	Requirements for credential strength.
Failed Attempt Limit	Threshold before rate-limiting or lockout.
Default Role	Role assigned to newly invited users.
Audit Retention	How long access records are retained.

Operational Scenarios

Scenario 1 — Onboarding a new developer An administrator invites a new developer, assigns a read-only role scoped to staging instances, and the developer gains visibility without access to production execution.

Scenario 2 — Responding to a security review During a review, the team exports the access audit log, confirming who accessed production instances and when, and verifying that only authorized users hold elevated permissions.

Scenario 3 — Offboarding a team member When a team member leaves, an administrator deactivates their account, immediately revoking access while preserving the audit trail.

Scenario 4 — Rotating database credentials A database password is changed. The administrator updates the stored connection credential in Beacon, and monitoring continues uninterrupted.

Summary

Beacon’s Access & Session Management module protects both the platform and the databases it observes. Through secure authentication, granular role-based permissions, instance-level scoping, credential protection, and comprehensive auditing, it ensures that observability data is accessible to the right people — and only the right people.