Enterprise Ready

[thomasdaly5]

Most SaaS providers gate enterprise features behind high-tier plans — but public clouds don’t. Datum Cloud brings those capabilities to all users, so every organization can operate with power and safety from the start.

---

Access & Authorization

• Social Signup and Login

• Support for GitHub and Google sign-up and login

• Org admins can enforce Google Login for all users

• Active Sessions

  • Provide visibility to users for into all active sessions
  • Allow users to revoke sessions to maintain account security

• Machine Accounts

  • Introduce machine identities for programmatic access to the platform
  • Enable automation and service-to-service integrations without human intervention
  • Use standard authentication and permission models

---

Team Management

• Standard Organizations

  • Users can create organizations for team collaboration
  • Org admins can manage members and permissions

• List Members & Invites

  • View current team members and pending invitations
  • Resend or cancel pending invitations

• Remove or Adjust Members

  • Remove users from teams and automatically revoke all active sessions
  • Owners and Admins can edit roles of existing members

---

Fine-Grained Permissions (RBAC / ABAC)

The first step in becoming Enterprise Ready is to move beyond coarse global roles toward fine-grained access control — defining what users can do by area, not just by title.

View Role Matrix

Top-Level Roles

• Owner
• Editor
• Viewer

---

Audit Logs

• Centralized stream of all user activity within an organization
• Fully exportable and API-accessible
• Searchable via portal interface or CLI

[mksinghtx]

In order of priority this is my list for Enterprise ready lmk what you think - A lot of things have already been done that we need to continue to maintain eg MFA, IAM with service accounts and federated identities. Happy to discuss further.
SCA and Supply chain security for OSS - #64
NGFW - L3-L7 protection via Next-gen firewall for all assets, resources, apps in the datum domain - NGFW protection for all Datum resources, assets - https://github.com/datum-cloud/enhancements/issues/69
Network and other resource access should be secured in line with zero-trust principles https://github.com/datum-cloud/enhancements/issues/68
API rate limiting - https://github.com/datum-cloud/enhancements/issues/66
Security operations center implementation #57
Attributes based access control is implemented for all Datum resources #65

[jacobsmith928]

@mksinghtx it seems to me we should first view this from a customer lens (e.g. platform features they can touch and consume), and then consider a separate list of investments that we need to adopt / document / promote for how we build and run our platform and company so that we can authentically be trusted by Enterprise (or any!) customer. What do you think?

[mksinghtx]

Here is what I am thinking

1. In my experience - enterprise customers will ask us about our internal processes that are supporting the services that our customer is consuming. Eg we are sourcing all our software from Open source in some form or other - how safe is it? "How are you sure it will not impact my services whether I run them( enterprise license scenario)or you run them". Ultimately it is a matter of trust - which i feel is important for the enterprise customer.
2. Features like API rate limiting for control-plane becomes important because of Denial of service attacks specially with agentic workflows.
3. NGFW is an absolute necessity, will be experienced by customer - in fact a layered security model becomes key - eg protection of DNS, LB, Proxy - actually the CEO of ownid asked about this in our call - "What ingress protection do you offer?" I am writing the PRD for this and should be ready by this weekend.
4. SoC is required to detect network threats on the edge and is an essential service for the customer to defend their edge against malicious traffic and intrusions.
5. Network access - This is for protection of customers as well as Datum and hence other customers who are consumers of the network eg Network as a service connecting via their branch. Every user of Datum's network must be authenticated/authorized/limited- we can talk about how granular it should be. Once we do with zero-trust principles we can defend better against breaches and intrusions by having for eg time-bound access policies or cutting off access based on traffic patterns(see SOC above).
6. Attribute based access control is finer granularity and can be mapped to a role for now but ultimately it should take into account temporal and spatial parameters in policy. If Datum resources(proxy or DNS instances)are compromised due to stolen, hijacked credentials, accidental leaks it puts customers at risk. With ABAC policies geographic or location and time parameters would mitigate this to an extent.