A server drive bay with rows of green and amber status lights.

Foundation

Access & Audit

Use company sign-in and preserve a complete history of every controlled action.

Phasis uses Keycloak so people sign in with the company identity controls managed by IT, including SSO, MFA, password policy and account lockout. Phasis stores no passwords, checks authorization on every request and removes access across all modules when the company account is disabled.

Roles provide read, write or approve access for each module. Approval includes controlled decisions such as calibration approval, work-order release and NCR closure. These permissions are enforced by the server, not only by what the interface displays.

Quality, Calibration, HSE, Permit to Work and Documents also prevent self-approval, even when one person holds both operational roles. Access is configured per module rather than per individual record or production line.

Who uses it

IT administrator
Manages company sign-in, SSO and MFA policy in Keycloak and disables access centrally.
System owner
Maps roles onto modules: read, write or approve.
Approver
Approves controlled work completed by another person.
Quality manager
Reads the history on a record and the central log when an auditor asks.
Auditor
Follows one record from entry to approval and sees who touched it.

Today vs Phasis

Today

With Phasis

TodayUser access has to be removed separately from several systems.
With PhasisDisabling the company account removes access across all Phasis modules.
TodayInterface visibility is treated as the access control.
With PhasisThe server checks the user's permission for every action.
TodayCorrections overwrite the original regulated entry.
With PhasisThe original is preserved and the correction is recorded separately.
TodayApproval history depends on email, signatures or local knowledge.
With PhasisThe record preserves the approver's name and approval time.
TodayField changes cannot be traced consistently to a person and time.
With PhasisThe database logs every insert, change and deletion with the affected fields.

Two complementary audit trails

The history on the record

Every regulated record shows who performed each action and when. An NCR keeps the reporter, investigator and approver; a maintenance job keeps who started, submitted and closed it. Names are stored with the action so the historical record remains complete after an account is disabled.

The central log

The database also records every insert, change and deletion, including the person, time and affected fields. The log cannot be edited or deleted and is available through Settings.

Regulated records are not deleted

Each record type has a controlled withdrawal path that preserves the original history.

NCR

Cancel. There is no delete.
Certification

Revoke, with a reason.
Inspection reading

Void, with a reason. The original stays.
Issued permit

Close. A draft can be canceled.
Calibration record

Reject. The correction is a new record.
Risk assessment

Revise. The old version is superseded.
SOP version

Supersede or retire.

What you get

Company-managed sign-in through Keycloak, with no passwords stored by Phasis.
Read, write and approve permissions enforced by the server for each module.
Independent approval controls that remain effective when one person holds both roles.
Record-level history showing who performed and approved each controlled action.
An immutable central log of every insert, change and deletion.