A telemetry service can read measurements but cannot modify devices’ firmware.

Every request to change actuator settings is checked against current permission rules, even after login.

A critical firmware push requires two distinct privilege attributes or approvals.

Separate building tenants use as few shared security-sensitive services as practical.

A newly enrolled sensor is denied access to management APIs until a rule explicitly permits it.