Security administration | Method Platform

This page describes the roles, account lifecycle procedures, and security settings available in the Method Platform.

Permission Management

The Method Platform uses Relationship Based Access Control (ReBAC) to specify which level of access each group has in relation to different platform resources. This is a similar authorization model to Role Based Access Control (RBAC), but is more flexible and granular, as a group can be granted different levels of access to different resources. For example, a group can be granted read permissions on some environments, edit permissions on others, and denied access to the rest.

A user’s permissions are derived from those of the groups to which they belong.

Please see the Managing permissions page for details on using the Administration app to manage the permissions and settings described here.

Platform Administration

Members of the Method Platform Administrators group can perform the following actions, which are not available to other users. User and group modification are not available if users and groups are synchronized from an identity provider via SCIM.

Create user accounts
Create, delete, and rename groups
Add and remove users from groups
Specify the access levels for other groups in relation to platform resources such as environments
Update tenant settings (organization name, logo, contact email, default application)
Create and manage SCIM integrations and tokens

Method configures the initial administrative group during platform onboarding. Existing administrators can add other users to the Method Platform Administrators group and/or remove themselves from it.

Environment Roles

For each environment in the Method Platform, a group can be a viewer, an editor, an owner, or none of the above. Users in a group that has no role for an environment cannot perform any of the operations in the table.

A group can have different roles in relation to different environments.

The Method Platform Administrators group is an owner for each environment by default. Additionally, a group can be granted the Environment Administrator role for the platform, which makes members of the group owners for all environments. This can be used to separate management of the overall platform from management of the environments.

The following table specifies the environment-level permissions associated with each role.

Action	Owner	Editor	Viewer
Manage Environment access	✅
Configure Environment No-Strike List	✅
Configure Environment network type	✅	✅
Create Jackals	✅	✅
Run Tasks	✅	✅
Configure Operation rules of engagement	✅	✅
Run Operations	✅	✅
Create Targeting Packages	✅	✅
Run Research Agents	✅	✅
Run Pentest Agents	✅	✅
Run Exploit Agents	✅	✅
View and export Ontology Objects	✅	✅	✅
View and export Findings	✅	✅	✅
View and export Reports	✅	✅	✅
View Targets	✅	✅	✅

For details on managing environment permissions, see Managing permissions.

Administration app

The Administration app provides centralized management for platform configuration. It includes sections for Environments, Tags, Issue Types, Jackals, Alerts, Cloud integrations, SCIM integrations, AI Inference, OAuth clients, API tokens, and platform settings. The API enforces actions that require administrative privileges.

For an overview of all capabilities, see Administration.

Account creation

The platform supports the following methods for creating user accounts.

SCIM provisioning (recommended)

User accounts may be provisioned through your identity provider via SCIM. In this case, users and group membership are all managed by your identify provider, and synchronized to Method. Users do not have separate Method credentials, and log in via your IdP.

Supported identity providers for SCIM integrations are Okta and Microsoft Entra ID.

For setup instructions, see the Okta SSO guide or Entra ID SSO guide.

SSO Without SCIM

It is also possible to configure SSO without SCIM. In this case, users log in via your identity provider and do not have separate Method credentials. However, users and group membership are not synchronized to Method, so account creation and group membership must still be managed within Method.

For setup instructions, see the Okta SSO guide or Entra ID SSO guide.

Manual account creation

Platform administrators can create user accounts from the Users section of the Administration app by providing a first name, last name, and email address. The platform generates a one-time temporary password that must be securely shared with the user. This password is displayed once and cannot be retrieved afterward.

On first login, the user must:

Change their temporary password
Configure TOTP-based multi-factor authentication

MFA requirements

SCIM-provisioned accounts: MFA is enforced by your identity provider. Configure MFA policies in Okta, Entra ID, or your chosen provider.
Manually created accounts: The platform requires TOTP-based MFA for all users. Enrollment is mandatory during first login and cannot be bypassed or disabled.

Session management

Users can view their active sessions and terminate all sessions from the platform. Session termination logs the user out across all clients and devices immediately.

Decommissioning administrative access

To remove administrative privileges from a user, remove them from the administrative group. The user retains their account but loses admin-specific permissions.

To fully decommission a user account:

SCIM-provisioned accounts: Deactivate or unassign the user in your identity provider. The platform disables the account but does not permanently delete it, preserving the ability to reactivate if the user is re-provisioned. To permanently remove all users and groups from a SCIM integration, delete the integration data from the SCIM Integrations section of the Administration app.
Manually created accounts: Contact your Method representative to decommission the account.

Security settings reference

The following tables describe admin-controlled security settings available in the Method Platform, organized by category.

Authentication and credentials

Setting	Function	Security impact	Recommended configuration
SSO identity provider	OIDC or SAML authentication through an external identity provider, configured during onboarding with Method	Centralizes authentication and enables enforcement of organizational security policies, including MFA	Enable SSO with MFA enforced at your identity provider. See SSO Overview.
SCIM integration tokens	Bearer tokens that authorize your identity provider to provision and deprovision users and groups. Managed in the Administration app.	A compromised token allows unauthorized user provisioning. Token values are displayed once at creation.	Set the shortest practical expiry (maximum 365 days). Rotate before expiration. Revoke unused tokens immediately.
API tokens	Personal access tokens for authenticating to the Method API. Managed in the Administration app.	A compromised token grants API access with the permissions of the token owner.	Set the shortest practical expiry (maximum 90 days). Revoke tokens when no longer needed.
OAuth client credentials	Client ID and secret for machine-to-machine API authentication. Managed in the Administration app.	Compromised credentials grant API access to the platform.	Rotate client secrets regularly. Delete unused clients. Secrets are displayed once at creation.

Access control

Setting	Function	Security impact	Recommended configuration
Group membership	For Method instances that do not use SCIM, users can be added to or removed from groups.	Controls which groups each user is part of.	Follow least privilege. Assign users to groups only as needed.
Environment permissions	The access level of each group for each environment can be modified through either the Groups page or the Environments page.	Controls what actions each user can perform within each Environment.	Follow least privilege, and only add viewer or editor groups as needed per environment.

AI and automation

Setting	Function	Security impact	Recommended configuration
Model Provider authentication	API keys or credentials for connecting to LLM endpoints. Managed in the Administration app.	Compromised credentials could be used to access your LLM provider account.	Use scoped API keys with minimal permissions. Validate authentication before enabling. See Add a model provider.
Model Defaults	Assigns which LLM handles Large, Medium, and Small AI requests. Managed in the Administration app.	Determines the capability and cost of AI features. Changing a default redirects all callers of that size class immediately.	Select models appropriate for your workload. See AI Inference.
Agent Policies	Allow, Deny, or Require Approval rules governing Agent actions with MCP Tools.	Controls the scope of autonomous AI Agent behavior. Without a matching Policy, all Agent actions default to Require Approval.	Default to Require Approval. Explicitly Allow only well-understood, low-risk actions. Scope Policies to specific Agents, Environments, or Tool risk levels.
Issue severity overrides	Override default Issue severity at the platform, tag, or Environment level. Managed in the Administration app.	Affects how Issues are prioritized and triaged.	Align with your organization’s risk tolerance and incident response procedures.
Agent auto-triggers	Enable or disable Agents that run automatically when Issues are discovered. Configured per Issue type in the Administration app.	Controls the scope of automated AI response to security findings.	Enable selectively. Review Agent behavior before enabling in production Environments.

Platform operations

Setting	Function	Security impact	Recommended configuration
Alert channels	Slack and Teams webhook URLs for platform event notifications. Managed in the Administration app.	Controls where notifications for new Issues, completed Task runs, and other events are delivered.	Configure alerts for all critical event types. Protect webhook URLs as sensitive credentials.
Cloud integrations	AWS IAM connections for cloud resource discovery and assessment. Managed in the Administration app.	Grants the platform access to your cloud environment.	Follow least privilege when configuring IAM roles. See the AWS Integration Guide.
Jackal configuration	Execution mode, exfiltration parameters, workflow execution, and C2 parameters per Jackal. Managed in the Administration app.	Controls the behavior and network footprint of deployed security agents.	Configure per your operational requirements and Rules of Engagement.

For SSO configuration, see SSO Overview. For permission management, see Managing permissions. For AI model configuration, see Add a model provider. To report a security concern, see Reporting security concerns.