# Account Security

Protecting user credentials and assigning appropriate access limits is highly straightforward using the **Account Security** settings panel.

---

## Security Configuration Architecture

The layout below traces the access parameters users configure to secure organization profiles:

```mermaid
graph TD
    %% Main Identity
    subgraph OwnerIdentity["Primary Administrator Profile"]
        ConfigAuth["Multi-Factor Authentication<br/>(Enforce SMS / Authenticator Apps)"]
    end

    %% Delegation
    subgraph TeamManagement["Role Delegation Setup"]
        RoleBilling["Billing Role Access<br/>(Restricted to Top-Up actions)"]
        RoleEngineer["Studio Role Access<br/>(Restricted to Script Layouts)"]
    end

    %% Target Access
    subgraph SecurePlatform["Protected Platform Tiers"]
        DbStore[("Encrypted Identity Ledger<br/>(Stores User Hashed Credentials)")]
    end

    %% Links
    ConfigAuth ==>|"Authorize Primary Login"| SecurePlatform
    OwnerIdentity -->|"Invite Sub-Users"| TeamManagement
    RoleBilling -->|"Token Scope Verified"| SecurePlatform
    RoleEngineer -->|"Token Scope Verified"| SecurePlatform

    %% Premium Stylized Themes
    classDef adminToken fill:#0f172a,stroke:#38bdf8,stroke-width:2px,color:#fff,rx:6px,ry:6px;
    classDef teamToken fill:#1e293b,stroke:#a855f7,stroke-width:2px,color:#fff,rx:6px,ry:6px;
    classDef platToken fill:#312e81,stroke:#ec4899,stroke-width:2px,color:#fff,rx:6px,ry:6px;

    class OwnerIdentity,ConfigAuth adminToken;
    class TeamManagement,RoleBilling,RoleEngineer teamToken;
    class SecurePlatform,DbStore platToken;
```

---

## Safety Management Controls

### 1. Multi-User Team Invitations
Primary corporate owners can dispatch invitation strings to custom email addresses, configuring dedicated permission checkmarks to prevent non-authorized team members from releasing valuable operational lines.

### 2. Active Session Monitoring
Security interface grids list active active browser sessions. Users can click terminal drop action icons to force logout unknown IP location access paths instantaneously.