Some actions deserve extra protection: deleting data, exporting everything, changing payout details, administering users.

​
Require a second factor

Choose All of: Record owner; Signed in with 2FA in the rule picker. All must pass: the owner, signed in with a second step (aal2). A password alone is refused with a 403.

​
Step-up in your app

When a person is signed in at aal1, don’t make them sign out. Catch the refusal, explain, and take them through the second step (the flow is in Two-step verification), then retry:
Check the level before you offer the action: (await pawabase.auth.mfa.status()).aal is aal2 once the second step is done.

​
Only your servers

Choose Secret keys & Studio in the rule picker. Nothing from a browser can do it. Wrap it in a route that checks everything and uses a secret key.

​
Admin with a second factor and a company address

Pick List and add Users with role admin, Signed in with 2FA, and a Custom condition with $auth.email ends with @yourcompany.com. Also turn on Require a verified email in Restrictions.

​
Keys with a specific scope

For an integration key:
  • All of these rules pass:
    • Key has scope orders:export
    • Uses a secret key

​
Limit by caller kind

Allow people, not anonymous or service callers:
  • Caller kind is user

​
Allow from known addresses

  • Compare values: $request.ip starts with 203.0.113.
Crude, and addresses can be shared or change. Prefer an API key’s allowed addresses (API keys) or the environment’s list of servers allowed to use secret keys (Environment settings).

​
Make it hard to delete

  • Leave delete off and use soft delete.
  • Or all of: Record owner; Signed in with 2FA.
  • Back up before bulk removals (Backups).

​
Audit it

Sensitive writes should leave a trail. Subscribe a flow to the table’s events and record the actor, the record and the time in an audit_log table only service can write (pattern). Also watch sign-in activity.

​
Alert on it

Use Auth webhooks for user.mfa_disabled, user.disabled, session.reuse_detected, and a webhook on your sensitive table’s events to notify your team.

Two-step verification

The step-up flow.

Roles

Staff roles.