DynamicPlantMesh
Request a demo

Security

Least privilege from sign-in to API key

Slot into the identity infrastructure you have in place. Every API key is scoped to exactly the endpoints it needs, and AI features stay off until you switch them on.

Request a demoAsk an integration question

Least-privilege ladder

Six rungs, each narrower than the last

Access narrows from who may sign in, to what a role may see, to which endpoints a single key may call.

  1. Sign-in

    Choose the native user store or Microsoft Entra ID OAuth2 per deployment. Users who authenticate externally are auto-provisioned on first sign-in, so there is no second user list to keep in step.

    2 sign-in providers · auto-provisioning on first sign-in

  2. Roles

    Admin, User and Viewer roles gate menus and features. An operator sees the dashboards and trends they need; only administrators reach the configuration editors.

    3 access roles · Admin / User / Viewer

  3. API keys

    Every key on the integration API belongs to a user and carries an endpoint allow-list, so a key issued for time-series reads can do nothing else. The KPI API is protected by a service key.

    2 governed endpoints · per-user allow-lists · service key on the KPI API

  4. Sessions

    Data-protection keys are persisted, so sign-ins stay valid across server restarts. A restart does not log the control room out.

    persisted data-protection keys

  5. Broker

    When authentication is enabled, the embedded MQTT v5 broker validates every connection before it can publish or subscribe. Configurable per deployment.

    embedded MQTT v5 broker · configurable per deployment

  6. AI

    Every AI feature fails closed: inactive unless explicitly enabled and fully configured. Switch the assistants on when you are ready; the rest of the platform never depends on them.

    2 in-app assistants · fail closed

Data sovereignty

Runs on your hosts, under your control

DynamicPlantMesh is built for on-premise, data-sovereign deployment; its assistants run through DBS Invenio, which can be deployed with models on your own infrastructure.

On-premise by design

The platform deploys on your own Windows hosts, with its historian and database beside it. The assistants run through DBS Invenio, which can be deployed with models hosted on your own infrastructure — ask about the local-model option for your deployment.

  • The historian, KPI logs and event logs stay on your hosts.
  • API keys are issued and revoked by your own administrators.
  • The AI assistants can be switched off entirely; nothing else depends on them.
  • Sign-in can stay on the native user store when no external identity provider is wanted.

In numbers

Access control at a glance

  • 2sign-in providers
  • 3access roles
  • allow-listedAPI keys per user

Bring the identity provider you have.

We will walk through sign-in, roles and API scoping against your own setup.

Request a demoAsk an integration question