# Security & access (/security)

A workspace layers several independent controls on top of each other: how someone proves who they are, what they're allowed to do once they're in, and a record of what happened afterwards. This section documents each layer.

## The access-control surface

* **Authentication** — how a member proves their identity: a password, an OAuth provider, or your own identity provider through [single sign-on](/security/single-sign-on).
* **Authorization** — [roles and permissions](/security/roles-and-permissions) decide what a signed-in member can do, enforced on every API call.
* **Account hardening** — [two-factor authentication](/security/two-factor-authentication) adds a second step to sign-in.
* **Automated lifecycle** — [SCIM provisioning](/security/scim-provisioning) lets an identity provider create, update, and deactivate members automatically.
* **Oversight** — the [audit log](/security/audit-log) records who did what, and when.
* **Change control** — [campaign approvals](/security/campaign-approvals) require a second reviewer before a send goes out.

## Who this is for

Workspace admins and security teams deciding who gets access to a project, which safeguards to turn on, and how to review what happens once people are in.

## In this section

| Page                                                             | Covers                                                          |
| ---------------------------------------------------------------- | --------------------------------------------------------------- |
| [Roles & permissions](/security/roles-and-permissions)           | Preset and custom roles, granular `resource:action` permissions |
| [Two-factor authentication](/security/two-factor-authentication) | TOTP and email-code verification at sign-in                     |
| [Single sign-on](/security/single-sign-on)                       | SAML and OIDC login through your identity provider              |
| [SCIM provisioning](/security/scim-provisioning)                 | Automated member lifecycle from your identity provider          |
| [Audit log](/security/audit-log)                                 | A record of who did what, and when                              |
| [Campaign approvals](/security/campaign-approvals)               | Four-eyes review before a campaign sends                        |

## What's next

Head to **Settings → Team & Roles** to see who has access to your workspace today, then start with [roles & permissions](/security/roles-and-permissions) to shape what each of them can do.