Skip to content

Security, roles & GxP configuration

Demo configuration

Who can do what at each site, the platform’s non-negotiable write boundary, and the tamper-evident audit trail. Designed to support 21 CFR Part 11 audit trails; validation is the customer’s responsibility and has not been performed here.

Frame SETTINGS-01

21 CFR Part 11 controls

Enabled

Part 11 controls enabled: e-signature meaning, re-auth, audit trail — validation status: not yet validated (demo)

Air-gap mode

ACTIVE

Models and connectors run inside the site network. No outbound traffic to external model APIs; updates are imported as signed bundles.

Audit log entries

38,412

Append-only · Mesa site

Live

Role access matrix

Grants apply per site. Locked cells enforce segregation of duties.

Role · MesaView dataDraft documentsPropose changesSign approvalsConfigure connectorsManage agents
MSAT
Supervisor
QA
Operator
SysAdmin
No unsaved changes. Saving records each grant or revoke as a separate audit entry.

DCS zero-writeback guardrail

Locked
LOCKED_READ_ONLY
  • No user, role or agent can write to DCS, PLC or MES from this platform.
  • Connectors are provisioned with read-only service accounts; there is no write code path to enable.
  • Changing this requires a separate, validated integration project under site change control — not a setting.

Why: process control changes are safety-critical and must go through the site’s own validated systems and approvals.

Audit log · chained hashes

Each entry includes the previous entry’s hash. Hashes are synthetic demo values, not SHA-256.

SeqTime (UTC)ActorActionObjectPrev hash → entry hash
384122026-10-19 12:02:37R. Oseiconnector.health_checkOSIsoft PI · PI-UFL-MESA-02sha256:09bd134b52…12f325 → sha256:7b6a35437a…d6e33d
384112026-10-19 11:40:20agent:lab-result-watchernotification.sentQC-948sha256:4969731011…d4ae05 → sha256:09bd134b52…12f325
384102026-10-19 09:40:52A. Riveramemory.confirmINV-104/m2sha256:e7f2c82b11…f2c2fd → sha256:4969731011…d4ae05
384092026-10-19 09:05:11P. Natarajanrecord.viewedQ-DEV-031sha256:dc6956144c…b42a75 → sha256:e7f2c82b11…f2c2fd
384082026-10-19 08:32:45agent:msat-yield-sentryproposal.routedRCP-AB014-V4.patch.02 → REV-01sha256:7b5dd1d45b…bf812d → sha256:dc6956144c…b42a75
384072026-10-19 08:26:04agent:msat-yield-sentryrun.start (read-only)RUN-2026-1042sha256:32112dfcf4…6d6b85 → sha256:7b5dd1d45b…bf812d
Showing the latest 12 of 38,412 entries. The export contains the entries loaded in this session plus the Merkle root, as JSON named audit-package-demo.json.