1. Purpose
Limit access to Moogul information and systems to authorized people and services with a legitimate need. This policy supports the Information Security Policy.
2. Scope
These rules apply to personnel, vendors, service identities, and AI agents accessing Moogul systems or information. They cover corporate tools, devices, cloud accounts, and development, staging, and production environments throughout the access lifecycle.
3. Access Requirements
- Use individual accounts and enforce multi-factor authentication (MFA) on every critical administrative system that stores, processes, or controls access to consumer financial data, including AWS and data-provider consoles. Never share personal logins.
- Require consumer MFA before opening a connection flow with our bank data providers. Authentication performed by a bank or bank data provider does not replace Moogul’s own MFA requirement.
- Record the person or service, system, business need, role, and CEO or designated system-owner approval before granting access. Restrict production and customer-data access to explicitly approved work.
- Use role-based access control (RBAC) and least privilege: assign only the permissions needed for the approved role. Use centralized identity and access management and approved Google Groups where the system supports them; record and review local-account exceptions.
- Restrict administrative network access with IP allowlisting and cloud security groups where applicable. These supplement centralized identity, group-based authorization, and MFA; a Google Group is not a network security group.
- Apply zero trust principles: verify identity and authorization for protected resources. Network location, staging access, or group membership alone must not confer unrestricted access.
- Scope service identities and AI-agent permissions to their task. Keep credentials in approved secret stores; never embed them in code, logs, tickets, or prompts. Rotate affected secrets after exposure or relevant departures.
- Record consequential administrative actions and customer-data access. Protect those records from unauthorized changes and restrict who can read them.
4. Access Reviews And Removal
The CEO or designated system owner must review sensitive accounts, roles, groups, service identities, and MFA at least quarterly. Record the systems checked, reviewer, date, findings, and changes; verify that permissions match current responsibilities.
Immediately remove access that is unnecessary, compromised, or no longer authorized following a departure or role change. Revoke affected sessions, keys, and credentials, and verify removal across the system inventory. Periodically audit access approvals, review records, and removals for omissions; track corrective actions.
5. Roles And Responsibilities
The CEO approves access authority and exceptions. System owners implement access controls and retain review/removal records. The Security Review Team checks findings and follows up on gaps. Everyone must protect credentials and report suspected unauthorized access immediately.
Follow the operating procedures for records and recurring checks. Policy review, exceptions, and enforcement follow the parent Information Security Policy.