Adding Your Team, Roles and Multi-Factor Authentication

Access is decided in your database. Its row-level security policies read the role on each person’s profile and, for anything sensitive, whether the session has passed a second factor recently. An account with the wrong role does not see a disabled button: it sees nothing, because the rows never come back. Security sets out the whole model.

The roles

External testers are for overflow work, one at a time or as a team from another consultancy, and external testers and teams for overflow pentest work covers switching them on and handing them engagements.

Add people under Users, Add User, with their email address, name and role. An administrator can give any role; a senior can give any up to senior. Client logins are added on the client’s own page instead, and what your clients see covers them.

Email them an invitation is ticked to begin with, and Add and invite makes the account and emails them a link to sign in. Untick it and the button says Add without an email: the account is made and nobody is emailed, so you choose when they hear from you. They can sign in from the sign-in page with their email address when they are ready, or you can send the invitation later with Resend invite.

Multi-factor

Every account needs a second factor: an authenticator app, or a security key or passkey. Under Settings, then Security, administrators and seniors choose which methods are allowed and whether one is enough or both are required. Setting up multi-factor authentication walks through it.

Whichever policy you pick, enrolling a passkey also asks for an authenticator app as a backup, unless authenticator apps are not allowed. A passkey is tied to the device it was made on and to your portal’s address: move the portal to a new domain, or back to your Pental subdomain, and passkeys are cleared, so anyone who used one signs in with an emailed code once and sets up a new one. An authenticator app keeps working through both.

Inactivity

The same screen sets two windows. After the Authenticator Re-verification minutes without activity (480 to begin with), a person enters their second factor again to carry on, and the session stays. Two minutes before, the portal says so, and Stay signed in, or simply carrying on, keeps the session going. However active somebody is, the second factor is asked for again a day after it was entered (or after the window, where that is longer). After the Full Sign Out minutes (1,440 to begin with, and always longer than the first: the screen will not save it otherwise), they are signed out and sign in from the start. When Re-verification Is Due, on the same screen and in the setup wizard’s security step, chooses what the first window does: ask for the authenticator code, still signed in, or sign out. A change applies at once, in every portal signed in.

Each person’s own active sessions are on the Active Sessions card of their dashboard, each with Revoke; administrators also have them under Settings, Security, with Sign out other devices.

When somebody loses their factor

An administrator or a senior resets it with Reset MFA on the Users list, or on the client’s Portal Users for a client login. They must have passed their own second factor in this session, and may reset only somebody below them: another administrator’s is the account owner’s to reset. The person sets up a new factor at their next sign-in.

Pental cannot do it. What Pental holds to reach your database (its address, its publishable key and a provisioning credential) cannot clear a second factor; that takes a signed-in administrator or senior of your portal, or your database’s owner. That is what stops a convincing support request becoming a route into your data.

If you somehow lose every administrator, recovery is through your own database, because it belongs to you. As the database’s owner, run select public.owner_reset_mfa('person@yourfirm.com'); in Supabase’s SQL editor (Studio’s, on a self-hosted stack), or with psql on PostgreSQL behind a Pental gateway, which has no SQL editor. It clears that person’s authenticator and passkeys, and they set up a new factor at their next sign-in. Nothing on pental.io can run it, and nothing Pental signs can either.

Worth doing on day one

• Enrol your own second factor before inviting anybody.
• Set the policy and the inactivity windows now, not after ten people have enrolled under the old ones.
• Add a second administrator. One administrator plus one lost phone is a bad afternoon.