---
url: /technical/modlr-security.md
description: >-
  MODLR security can be considered across Instance Security, Application
  Security, and Authentication.
---

# MODLR Security

MODLR security falls into two related parts: security *within* the platform, once a user is already in, and security to *enter* the platform in the first place.

## Security within MODLR

Governs what an authenticated user can see and do once they're inside.

* **[Instance Security](/technical/instance-security)**: governs read, write, or no access to objects within a model, such as cubes, dimensions, elements, cards, and workviews. Applied at the instance level via Groups.
* **[Access Tags and Application Security](/technical/access-tags-and-application-security)**: governs whether a user can reach a screen, or an element, within an application at all.

See [Screen access vs. Instance security](/technical/modlr-architecture#screen-access-vs-instance-security) for how these two relate to one another.

## Security to access MODLR

Governs how a user gets in, before Instance Security or Application Security ever come into play.

* **[Authentication](/technical/sso)**: governs how a user proves who they are and signs in, including Single Sign-On (SSO).
* **[Client Login and Password Rules](/technical/company-security)**: governs password expiry, login attempt limits, and password complexity for a client's users.