ZStack Cloud supports a Three-Role Separation model, which is an implementation of the Separation of Duties. This model decomposes the super administrator (admin) privileges and assigns them to three distinct roles: the System Administrator, the Security Administrator, and the Security Auditor. The System Administrator is responsible for managing platform resources. The Security Administrator is responsible for managing platform permissions. The Security Auditor is responsible for platform auditing ad compliance. These three roles operate independently and provide checks and balances on each other's authority.

By distributing the comprehensive privileges of the super administrator among three separate roles, this model effectively mitigates security risks associated with over-concentrated super-administrator access and significantly enhances the overall security posture of the platform.

Tenant management provides enterprise users with organizational structure management, project-based resource access control, ticket management, independent zone management, and other functions. The tenant management module is offered as an independent feature, which requires a separate license.

The Cloud provides a certificate login feature based on the Shang Mi 2 (SM2) algorithm. After enable this feature, you must use a UKey for login authentication to ensure identity authenticity.

To use this feature, ensure that you have the module license of cryptography security compliance installed and certificate login enabled.

Certificate login can be enabled for the admin or tenants. To enable certificate login for tenants, ensure that the tenant management module license is installed on the Cloud.