RBAC Premium + AI
The Premium RBAC tier extends the base RBAC module with three capabilities that matter most for regulated tenants: enforced two-factor authentication, transparent field-level encryption, and AI-powered anomaly detection.
Premium tier. This module is part of the ORKSTRA Premium plan. Contact sales@orkstra.com to enable.
Overview
If your tenant handles PDPL-regulated personal data, government bids, or other sensitive content, the base RBAC is the floor — Premium is the ceiling. The three capabilities work independently and can be enabled or disabled per role.
Key concepts
2FA enforcement per role. You can mark any role as MFA-required. Users assigned that role cannot sign in unless they have MFA enrolled. If they don't, they get a forced enrolment screen on their next login. ORKSTRA supports TOTP (Authy, Google Authenticator, 1Password) and WebAuthn / passkeys.
Fernet field-level encryption. Specific sensitive columns (national ID numbers, bank account numbers, salary figures, passport numbers) are encrypted at rest using AES-128-CBC via Python's cryptography.fernet. The encryption key is stored in a managed KMS-backed secret and rotated every 90 days. Decryption is transparent to authorized users; unauthorized users see masked values like ••••1234.
Heuristic AI anomaly detection. A nightly job scans the audit log for patterns that statistically deviate from each user's normal behaviour — logins from new geographies, after-hours access spikes, mass-download of documents, unusual approvals. Flagged events appear in the Anomalies dashboard for admins to review.
Audit trail. Every Premium feature writes detailed audit entries. Decryption events log the requesting user, the field accessed, and the reason (if a reason workflow is enabled).
Step-by-step: enable 2FA for a role
- Go to Admin → Roles → [role] → Security.
- Toggle Require MFA to On.
- Save. Users assigned the role get a forced enrolment screen on next login.
Step-by-step: encrypt a field
Field encryption is configured at the tenant level by a Premium admin:
- Admin → Security → Encrypted fields.
- Pick the model and column.
- Confirm — ORKSTRA queues a background job that encrypts existing values.
- Once the job completes, the field is encrypted on every read.
Common tasks
- Reset a user's MFA: Admin → Users → [user] → Reset MFA. The user must re-enrol on next login.
- Issue recovery codes: generated automatically at enrolment; can be regenerated under User → Profile → Security.
- Review anomalies: Admin → Security → Anomalies lists open events in priority order.
- Acknowledge or escalate: anomalies can be dismissed (with a reason note) or escalated to incident response.
Troubleshooting
- "User is locked out after MFA was enforced and they lost their device." — Have them use a recovery code. If none, an admin can reset MFA from Admin → Users.
- "Encrypted field shows the raw value to an unauthorized user." — That should not happen. File a ticket immediately — it usually indicates a cached query path that bypassed the decryption hook.
- "Anomaly dashboard is empty." — The detector needs at least 30 days of baseline data per user. New users won't have anomalies flagged until the baseline is built.
- "Login fails with 'MFA required' error." — User has a role that requires MFA but hasn't enrolled. Direct them to the forced enrolment flow.
Compliance & audit
Premium RBAC features are designed to satisfy PDPL (UAE), GDPR-equivalent obligations, and standard SOC 2 control points. The audit log retains 7 years by default. Premium tenants can also enable Immutable archive which writes a hash chain to a separate append-only store.
Permissions reference
| Permission | Who needs it |
|---|---|
RBAC_PREMIUM_VIEW | Admins, Security officers |
RBAC_PREMIUM_CONFIGURE | Tenant admins |
RBAC_PREMIUM_ANOMALY_REVIEW | Security officers |
RBAC_PREMIUM_MFA_RESET | Admins |
RBAC_PREMIUM_DECRYPT_VIEW | Specific roles only |
See also: RBAC, Audit Log, Admin → Security.