# Section 4 – Security & User Management Gaps

- **Role-based access control**: The generic API controller instantiates models without enabling the `AuthorizationEngine`; all permission checks are commented out, so RBAC is effectively bypassed (`api/controllers/GenericController.php:23-60`).
- **Multi-factor authentication**: TOTP enrollment and login challenges now flow through `UsersController::enableTOTP()` and `UsersController::login()`, with secrets stored via `user_mfa_factors`/`user_mfa_totp` and verified when present. Users without an enrolled factor continue to log in with username/password only, while passkey/WebAuthn assertions remain a TODO.
- **Data encryption**: The configuration layer lacks encryption helpers or key management; credentials and procurement payloads are stored and transmitted in plain JSON (`api/controllers/GenericController.php:30-78`).
- **Audit logging**: Create/update/delete operations run through `GenericController` and only enqueue generic notifications—no SIEM-grade audit events capture user, action, and payload details (`api/controllers/GenericController.php:120-170`).