Section
Access & security
Users, roles and permissions, data access rules, single sign-on, tokens, sessions, auditing and the security model.
Users & rolesThe built-in roles from Super Admin to Guest, what each can do, and how role assignment works.Data access rulesPer-user and per-role database/table rules with wildcards, regex patterns, deny precedence and priority ordering.Permission catalogEvery permission, what it allows and which built-in roles hold it — generated from the server.Single sign-on (SSO)Delegate authentication to OIDC, OAuth2 or SAML identity providers with role mapping, JIT provisioning and config-file/env layering.Personal access tokensMint ch_pat_… tokens in Preferences to authenticate the CLI, MCP agents and CI — scoped, revocable, verified live.Sessions & JWTShort-lived access tokens, long-lived refresh tokens, session expiry recovery and issuer/audience overrides.Audit loggingEvery user action and query recorded with actor, connection and timestamp; filter, export and retention behavior.Audit event catalogEvery action the audit log records, by area — generated from the server.Security modelEncrypted credentials, Argon2id hashing, JWT verification, SQL parsing against data access rules and audit coverage.