A valid certificate and a live session prove who is calling — they grant nothing. Permissions resolve through users, groups, roles, and business units into more than sixty discrete rights, each grantable as view, add, edit, delete, or execute. Security administration itself is decomposed, so separation of duties is something you configure, not something you hope for. Any error while evaluating a right denies it.

Every login attempt — successful or not — is recorded with source IP, machine, OS user, and client application. Every configuration change is audited field by field, old value and new. Security events land in the service log and the Windows event log with the context an analyst actually needs: which certificate, which endpoint, which user, from where.