Being logged in isn't enough to approve a DPIA or enable screenshots - here's why
A stolen session token, a laptop left unlocked, an admin account with a stale password reused elsewhere - all of these grant a valid login. None of them should be enough to do something that's hard to walk back. Step-up re-authentication is the difference.
Most actions in Custelis only need a valid session: viewing activity data, running a report, checking a device's status. A specific, deliberately short list of actions need something more - a fresh password entry (and a live authenticator code, for MFA-enabled accounts) at the moment of the action itself, not just at the start of the session.
What actually requires it today
How it actually works
A step-up token is short-lived - minutes, not the hours or days a normal session lasts - and issued only after re-entering your password, plus a live TOTP code if MFA is enabled on the account. It's sent as a header on the specific sensitive request, checked server-side against the real issued token (or, for MFA accounts, a live code is also accepted directly). Attempt the action without one and the server returns a clear "step-up required" response before anything happens - not a silent failure, not a bypass.
Why this instead of just "require MFA everywhere"
Requiring MFA on every single click would just train people to enter codes reflexively, which defeats the point - the friction has to land on actions where a second's pause is actually worth something. The list above is short and specific: things that reduce protection (turning screenshots on), things that grant broad access (impersonation), or things that are hard to walk back cleanly (a legal hold). Viewing a report doesn't need a step-up. Approving a DPIA does.
What a stolen session token can't do: even with a valid, unexpired bearer token for an admin account, an attacker without the account's actual password (and MFA code, if enabled) cannot approve a DPIA, enable screenshots, or start an impersonation session. The token alone only grants what a normal session grants.
Related reading
See what's step-up gated, live
No credit card to start. Intrusive features stay off until your own DPIA is recorded.
Try for free