We also control production engineers' access to production environments. A centralised role and group management system is used to define and control engineers' access to production services.

As part of our security protocol, engineers authenticate with short-lived personal public key certificates. Issuing these certificates is itself protected by two-factor authentication.