# WYG Production Access Standard — Pilot

**Updated:** August 23, 2026

## Access rules

1. Production hosting, database, object storage, domain, source, monitoring, and secret-management access is granted only to named people with a current operational need.
2. Every maintainer uses an individual account protected by multifactor authentication. Shared administrator accounts, shared browser profiles, and shared long-lived access tokens are prohibited.
3. The least privilege needed for the task is used. Read-only monitoring does not receive database restore, source write, or deployment authority.
4. Production data is not copied to personal devices or development environments. Recovery drills use synthetic data.
5. Athlete and coach accounts cannot reach WYG operational endpoints. `/api/ops/readiness` remains disabled until a unique 32+ character `WYG_OPS_TOKEN` is stored as a protected runtime secret.
6. Secrets are never committed, placed in URLs, sent through chat, or written to support tickets. Rotate after exposure, staff change, significant incident, or according to the signed security schedule.

## Approval and review

- New production access requires approval from the WYG owner and one additional designated reviewer.
- Access is reviewed before pilot launch, quarterly, and immediately after a role or vendor change.
- Emergency access is time-limited, recorded, reviewed within one business day, and removed when the incident ends.
- Every deployment must identify the approved source version and pass the required release checks. Direct unreviewed database changes are prohibited.

## Maintainer register

| Person | Role | Systems | Privilege | MFA verified | Approved by | Last reviewed | Remove by |
|---|---|---|---|---|---|---|---|
| [NAME] | [ROLE] | [SYSTEMS] | [LEVEL] | [DATE] | [APPROVERS] | [DATE] | [DATE / ACTIVE] |

This register is restricted operational evidence and must not be posted publicly with names or account identifiers.