Security, access control and compliance
Two security layers
Platform security is split between LifeTime and each environment's Service Center. LifeTime controls platform users, roles such as Administrator and IT Manager, and application permissions. Service Center controls authentication and session policies: password rules, session timeout, IP filtering, and SSO configuration. Application-level roles are separate from platform roles.
Least privilege in practice
- Give Administrator only to the small group that manages the platform itself.
- Use IT Manager or per-application deploy permissions for release engineers, scoped to the environments they need.
- Keep Development, Quality, and Production policies aligned unless a documented exception exists; drift is a compliance finding.
- Terminate TLS at the load balancer and enforce secure cookies; verify certificate expiry and renewal ownership.
- For SSO, monitor IdP certificate expiry and clock skew; keep a documented break-glass local administrator path.
Worked example
A contractor must deploy to Quality but not Production. You do not grant Administrator. You assign a role that allows deployment in Quality and grant only open/change permissions on the specific applications. Reasoning: deployment rights are environment-scoped; platform-wide administration would exceed the task and create an audit exception.
Traps
- Granting Administrator because role scoping feels slow.
- Confusing application roles with LifeTime platform roles.
- Changing a password or session policy in Production only and calling it aligned.
- Assuming SSO removes the need for local emergency access.
- Forgetting that IP filtering and SSO settings are per environment.