Secure configuration guide

This guide is for the people who administer a Specset organization. It names the accounts that control an organization, gives the security settings Specset recommends for an organization that holds federal information or CUI, and explains how account access is requested and recovered.

Recommended settings version 2026.09.18.2. See Versions.

Accounts that control an organization

Set roles on the Members page. No one can grant a role above their own. See Members & roles.

Specset creates each organization, adds its first Admin, and turns CUI mode on. Specset staff who can do this sign in through corporate SSO with a security key or passkey, and are able to change an organization's members and settings. They cannot read or set your password, or sign in as you.

Recommended settings

Specset creates an organization for federal information or CUI with CUI mode on and the settings below already saved. Only an Admin can change them, under Org Settings → Security & SSO. For each control, see Organization security.

CUI mode is set by Specset, not by an Admin. It keeps model, embedding, and web-search calls in Specset's Google Cloud Assured Workloads project, and turns off the support messenger and the Procore and Autodesk integrations.

Use your identity provider

If your organization has Okta, Microsoft Entra ID, or Google Workspace, you can require it in place of Specset passwords and passkeys.

1. Connect the provider and test a member sign-in. See Single sign-on.
2. Ask Specset support to confirm that sign-ins from your provider meet the MFA required setting. Connecting a provider does not establish this by itself.
3. Set Single sign-on (SSO) to Required and click Save.

Sign-in and account recovery then depend on your identity provider. Specset cannot reset them.

Manage Admin accounts

Set up the first Admin

1. Accept the emailed invitation and set a password.
2. Add a passkey under Account Settings → Sign-in & security.
3. Generate recovery codes and store them somewhere safe. See Account security.
4. Add a second Admin. Give each Admin their own account, and do not share one.

Change security settings

Saving under Security & SSO asks for a sign-in made in the last five minutes that meets both the current and the new settings, so you cannot save settings that lock you out. Saving does not enroll anyone else. Before you raise a requirement, check that every member has a passkey or a working SSO sign-in.

Review your settings

Compare your settings with this guide after each change and whenever you review who has access. Each saved change is emailed to the Admin who made it. Specset does not show a history of earlier values or of role changes, so keep your own record.

Any member can read the settings as JSON through the Specset API, for example with specset api in the Specset command-line tool:

query OrgSecuritySettings($orgId: ID!) {
  org(id: $orgId) {
    cuiModeEnabledAt
    authPolicy
    authenticationStrength
    nativePasswordEnabled
    nativePasskeysEnabled
    nativeTotpEnabled
    onboardingPolicy
    sessionMaxAgeMinutes
    identityProviders { provider displayName issuerUrl hostedDomains }
  }
}

The recommended settings return these values. The same values, with their version and release history, are published as a file for tools to compare against: secure-configuration.json.

{
  "authPolicy": "PasswordOnly",
  "authenticationStrength": "MultiFactor",
  "nativePasswordEnabled": true,
  "nativePasskeysEnabled": true,
  "nativeTotpEnabled": false,
  "onboardingPolicy": "InviteOnly",
  "sessionMaxAgeMinutes": 720
}

To run a query, save it to a file and pass your organization's ID, which specset org list shows:

specset api --query "$(cat org-security-settings.graphql)" -F orgId=<org-id>

Any member can also list who holds each role, the same way. Add roles: [Admin, Manager] after statuses: [Active] to list only the Admin and Manager accounts:

query OrgMembersAndRoles($orgId: ID!) {
  orgMembers(orgId: $orgId, statuses: [Active]) {
    role
    status
    user { email firstName lastName }
  }
}

Remove an Admin

1. Give another person the Admin role first. An organization can remove its last Admin, and restoring one takes a request to Specset support.
2. On the Members page, deactivate the departing Admin or remove their seat. Access ends on their next request. Deactivating is reversible and records who did it and when.
3. If you use SSO, also disable the person in your identity provider.

A Manager can deactivate an Admin, so give the Manager role only to people you would trust with that.

To close an organization and delete its data, an Admin writes to support@specset.com.

Account access

A person who needs access asks a Manager or Admin of their organization, not Specset.

• Add a member. Add member creates an invited seat with no access until the person accepts. Re-sending an invitation replaces its link. Invitation links do not expire, so revoke an invitation you no longer want.
• Remove a member. Deactivate the member or remove the seat. Disabling a person in your identity provider does not end a Specset session that is already open, so deactivate them in Specset too.
• Forgotten password. Forgot your password? emails a single-use link that is valid for ten minutes. A reset signs out every session and keeps the MFA and SSO requirements.
• Lost passkey. With their password and a saved recovery code, a person has five minutes to set up a replacement. The old passkeys, codes, and sessions are then revoked.
• SSO. Recover the account in your identity provider.

Every credential, recovery, and email change is emailed to the account's holder.

When to contact Specset

Write to support@specset.com to:

• create an organization or restore its Admin,
• connect a Google Workspace provider, or add email domains for Okta. Specset confirms that you own each domain first,
• recover an account that has no self-service recovery, such as one in an organization that requires phishing-resistant MFA.

A recovery request comes through your organization's Admin. Specset confirms the person's identity separately from the request and then issues a one-use approval that lasts one hour. The account holder is emailed, and the person still needs their password and a new passkey.

Versions

A change to the recommended settings gets a new version, a row here and a new edition of secure-configuration.json. Specset does not apply a new version to an organization that already exists, or to one switched to CUI mode after it was created. An Admin applies the settings from this guide.