# Authentication and Access Control

## Purpose

This guide explains how users sign in securely, use two-factor authentication (2FA), manage recovery codes, and work within the permissions assigned to their account.

Access to the system is controlled by both the user's account status and their assigned roles and permissions. A screen or button may not be visible when the account does not have the required permission.

## Signing In

1. Open the sign-in page.
2. Enter your email address and password.
3. Select **Sign In**.

Only active accounts can sign in. For security, the system uses the same general sign-in failure message for an incorrect password and an inactive account. Contact an administrator if you believe your account should be active.

## Optional Two-Factor Authentication Prompt

After a successful sign-in, users who have not enabled 2FA are taken to an account-protection prompt.

Choose one of the following:

- **Set up two-factor authentication:** Opens the Security page to begin setup.
- **Skip for now:** Opens the application without enabling 2FA. The choice applies to the current sign-in session; 2FA remains available later from the account menu.

Users with confirmed 2FA proceed through the normal 2FA sign-in challenge instead of this prompt.

## Enabling Two-Factor Authentication

1. Open the account menu in the top-right corner.
2. Select **Security**.
3. Select **Enable two-factor authentication**.
4. In an authenticator app, scan the displayed QR code. You may enter the setup key instead when scanning is unavailable.
5. Enter the current code generated by the authenticator app in the **Authentication code** field.
6. Select **Confirm**.
7. Store the displayed recovery codes in a secure location.

The setup is not complete until the authentication code is confirmed. If you leave and return to the Security page before confirming, the QR code, setup key, and confirmation field remain available.

## Signing In With 2FA

When 2FA is enabled, enter your email address and password as normal. The system then asks for either:

- the current code from your authenticator app; or
- a recovery code.

Select the recovery-code option on the challenge screen when you cannot access your authenticator app. A recovery code can be used only once.

## Recovery Codes

Recovery codes are emergency sign-in codes. Treat them like passwords.

### Viewing Codes

Open **Account menu > Security**. Confirmed 2FA accounts display the currently available recovery codes.

### Regenerating Codes

1. Open **Account menu > Security**.
2. Select **Regenerate recovery codes**.
3. Save the newly displayed codes before leaving the page.

Generating new codes invalidates all previous recovery codes immediately.

### Disabling 2FA

1. Open **Account menu > Security**.
2. Select **Disable**.
3. Confirm the action if prompted by the browser.

Disabling 2FA removes the authenticator setup and recovery codes. You can enable it again at any time.

## Account Status

An account can be **Active** or **Inactive**.

- Active users can sign in and use the resources permitted by their roles and permissions.
- Inactive users cannot sign in. Their active API tokens and application sessions are revoked when their account is deactivated.

### Activating or Deactivating a User

Users with the **Update Users** permission can manage account status from:

**Settings > User Management**

The user list shows each account's current status. Use the status action beside a user to deactivate or reactivate the account.

The following safeguards apply:

- Deactivating a user immediately signs that user out of active sessions.
- The system does not allow users to deactivate their own account.
- The status action is unavailable without the required permission.
- Reactivating an account allows the user to sign in again; it does not restore previously revoked sessions or tokens.

## Roles and Permissions

Roles group the permissions that define what a user may view or change. The system supports functional roles such as Administrator, Partner, Lawyer, Paralegal, Accountant, Client, and HR.

Examples of controlled areas include:

| Area | Required access |
| --- | --- |
| User Management | View, create, update, or delete user permissions as applicable |
| Roles and Permissions | Manage Roles permission |
| System and branding settings | View or update settings permission |
| HR administration | The relevant staff, leave, payroll, attendance, or performance permission |
| Audit logs | View Audit Logs permission |

The interface hides or disables actions that are not available to your account. The server also checks permissions, so an action cannot be performed by calling its URL or API endpoint directly.

Role and permission changes take effect on subsequent requests. Signing out and back in is normally not required.

## Audit and Security Activity

Authorized users can review audit records from the account menu by selecting **Audit Logs**. These records may include account creation and updates, role or permission changes, sign-in and sign-out events, failed sign-in attempts, and account activation changes.

Audit records are read-only through normal application use. They are retained to support operational review and compliance.

## Troubleshooting

| Situation | What to do |
| --- | --- |
| Sign-in fails | Check your email and password. If they are correct, ask an administrator to confirm that your account is active. |
| No 2FA prompt after sign-in | Open **Account menu > Security** and enable 2FA directly. |
| QR code or confirmation field is not visible | Refresh the Security page. If setup was already started, the page should show the pending confirmation controls. |
| Authenticator code is rejected | Ensure the device time is set automatically, then enter a newly generated code. |
| Authenticator device is unavailable | Use an unused recovery code. Ask an administrator for account assistance if no recovery codes remain. |
| Recovery codes changed unexpectedly | Generating a new set invalidates every previous recovery code. Use only the current displayed set. |
| Cannot see an action or page | Your account may not have the required permission. Contact an administrator or the role manager. |
| Account was deactivated | An administrator with user-update access must reactivate it. |