Roles and separation of duties

The Owner#

A store starts with one person, its Owner: aertun init --owner NAME. The Owner holds the administrator role over the whole store, and nothing can take it away — not another administrator, not single sign-on provisioning, not a deny, not an end date. Ownership moves only when the Owner asks for a transfer and confirms it a day later; any administrator can decline it before then, and Aertun's own detections raise the request.

aertun auth owner
aertun auth owner transfer lee@example.com --note "handing over"
aertun pending approve ID     # the Owner, a day later

The new Owner must already administer the whole store with no end date.

Collaborators#

Everybody else is a collaborator: an administrator grants them a role, a job or one permission, and sends the one-time link aertun auth enrol NAME prints.

Role	May
viewer	read findings, cases, the vulnerability queue and the dashboards
analyst	triage findings, open cases and add notes to them, hunt through events
responder	run cases, ask for an action on another platform, approve somebody else's action, accept a risk
admin	manage people, connectors and their credentials, and settings

Each role includes the ones before it. Beside the ladder are jobs, for a different kind of work rather than more of it: an engineer tunes detections and automation rules, a vuln-manager decides vulnerabilities, and an auditor reads the queue and the audit log for a set time, after which the grant ends by itself. A grant can cover everything or only the security area (--on /@security), can end (--for 30d), and a deny always wins. There are deliberately no custom roles: assembling permissions is how a role surface stops being reviewable. aertun auth roles prints the whole model.

Duties kept apart#

• An action on another platform is approved by somebody other than whoever asked.
• Whoever wrote an automation rule does not approve the runs it holds.
• Making somebody an administrator, issuing an administrator's token, weakening a setting, lowering how many approvals a change needs and moving the audit log each take a second administrator.
• An only administrator is slowed, not blocked: their own request waits an hour (a day to move the audit log), is raised by Aertun's detections over its own audit log, can be declined from any administrator's session, and only then may they approve it themselves. The record says it was approved alone.
• Agents propose; people decide. An AI agent's authority is the intersection of its registry entry, the live grants of the person it acts for, and its token's own limits. It may ask for a privileged change, but never approve one, approve an action on another platform, or move ownership.