Administration
Security

Security

This page helps you decide how people get into your organization and what By Dawn keeps of their sessions. By the end you’ll know what each card in Settings, then Organization, then Security does, and what changing it does to people who are already signed in.

Security is for owners and admins: members don’t see it. Admins can read every card, but only the owner can change them. Each card says so for an admin, such as “Only the organization owner can change the sign-in policy.” The cards, in order, are Sign-in policy, Require a passkey, External access (bridge policy), API keys and Session transcripts. API keys have a page of their own. So does the AI agents (MCP) card, which lets members connect their own AI agents: see AI agents (MCP).

Sign-in policy lists “Which methods people may use to sign in to this organization”, each with a switch:

Method	What it is
Passkeys	Touch ID, a security key, or a phone.
GitHub	Sign in with a linked GitHub account.
Google	Sign in with a linked Google account.
Magic link	A one-time sign-in link, emailed.
Email code	A one-time numeric code, emailed.
Single sign-on (OIDC)	Your identity provider, over OpenID Connect.
Single sign-on (SAML)	Your identity provider, over SAML 2.0.

Every method starts on. A switch saves as soon as you flip it, and the last method that’s on can’t be turned off, because people need some way in. The single sign-on methods also need a connection to your identity provider, which you set up in Single sign-on.

By Dawn checks the policy every time someone opens your organization, not only when they sign in. So when you turn a method off, people who signed in with it are turned away on their next click, and asked to sign in another way, such as “Your organization doesn’t allow Google sign-in. Use an email code instead.” They stay signed in to any other organization that allows it.

Require a passkey

Require a passkey makes everyone in the organization use a passkey: “Every member must sign in with a passkey to use this organization. Single sign-on through your identity provider counts too.” Passkeys are phishing-resistant, so a stolen email code or Google password isn’t enough to get in.

It depends on your organization’s plan. If the plan doesn’t include it, the card says “Requiring a passkey for every member isn’t on your plan. Members can still add passkeys themselves.”

Sign in with your own passkey first. By Dawn won’t let you require one while you’re signed in another way, because you’d lock yourself out: it says “Sign in with your passkey first, so requiring one can’t lock you out.” and offers Sign in with your passkey.
Turn on Require a passkey for every member.
Read the confirmation and choose Require passkeys.

On their next request, anyone signed in with an email code, a magic link, Google or GitHub sees that your organization requires a passkey. Someone with a passkey chooses Sign in with your passkey. Someone without one chooses Add a passkey, then signs in with it. A session through your active single sign-on connection already counts, so those people aren’t asked.

If your plan stops including it, the requirement isn’t enforced any more. The card then says “Your plan no longer includes this, so it isn’t enforced. Turn it off, or upgrade to enforce it again.” Turning it off always works, whatever your plan.

By Dawn staff access

External access (bridge policy) decides “How on-behalf-of access from outside the organization is approved”. That’s access By Dawn’s own staff get to act in your organization, for example while helping you with a support request.

Option	What happens
Require approval	Every external bridge grant waits for an owner to approve it.
Auto-approve, notify	Grants apply immediately, but owners are notified each time.
Open	External bridge grants apply immediately, with no approval or notice.

Organizations start on Open. The app doesn’t list these grants yet, so pick Auto-approve, notify or Require approval if you want to hear about each one.

Session transcripts

Session transcripts decides whether By Dawn keeps the log of each agent session after the agent stops. A transcript is end-to-end encrypted.

Store transcripts keeps them. It starts off.
Keep transcripts for sets how many days By Dawn keeps each one, from 1 to 365, and starts at 30. Your plan may allow fewer, and the card says so: “Your plan allows up to” a number of days. If your plan changes to allow fewer, older transcripts are deleted to match.
Serve on demand when storage is off lets someone open a finished session’s log straight from the machine it ran on, without By Dawn keeping a copy: “Stream a finished session from its machine. Nothing is kept.” It starts on.

A project can narrow these for itself, such as keeping its transcripts for fewer days, but never widen them: its admins do that in the project’s Transcripts settings.

The card shows how much space your transcripts use. Delete all transcripts deletes every stored transcript in the organization after you confirm. It can’t be undone.

Only the owner’s changes save here. An admin can move the controls, but By Dawn refuses the change.

FAQ

Someone can't sign in after I changed the policy. What happened?

They’re using a method you turned off. They see which methods to use instead. Turn the method back on if you need to, or help them add a passkey.

Does requiring a passkey affect API keys or agents?

No. It applies to people signing in. API keys and the machines your agents run on sign in their own way.

Can I turn off everything except single sign-on?

You can, but think about who it leaves out. Single sign-on only signs in people whose email is at one of your verified domains, so contractors and anyone else with another email couldn’t get in at all. For most organizations, offering single sign-on (Enforcement at Optional) and keeping Passkeys on is the safer choice.

Where to go next

API keys: let scripts and services use the board API.
Single sign-on: sign people in through your identity provider.