---
title: "Security for Aerospike Graph"
description: "Overview of Aerospike Graph security features including RBAC, TLS encryption, and audit logging."
---

# Security for Aerospike Graph

> For the complete documentation index see: [llms.txt](https://aerospike.com/docs/llms.txt)
> 
> All documentation pages available in markdown.

Aerospike Graph Service (AGS) supports role-based access control (RBAC), TLS encryption, and audit logging. Use these features together to build a comprehensive security posture for your graph deployment.

## Access control

AGS supports two levels of access control: database-level RBAC (if your Aerospike cluster already uses RBAC) and graph-level RBAC using JWTs. Use one or both depending on your security requirements:

Database-level RBAC

Authenticate against an RBAC-enabled cluster.

[RBAC with Aerospike Database](https://aerospike.com/docs/graph/manage/security/rbac-aero/)

Graph-level RBAC

Assign roles to users with JWTs.

[RBAC for AGS](https://aerospike.com/docs/graph/manage/security/rbac-graph/)

## Encryption

AGS supports TLS encryption for data in transit between your application and AGS, and between AGS and Aerospike Database. You can enable TLS on either or both connections. Start with the TLS overview to understand the architecture:

TLS architecture

Understand TLS across Aerospike Graph.

[TLS overview](https://aerospike.com/docs/graph/manage/security/tls/)

Client encryption

TLS for Gremlin client connections.

[TLS between application and AGS](https://aerospike.com/docs/graph/manage/security/tls/tls-gremlin-ags/)

Backend encryption

TLS for connections to Aerospike Database.

[TLS between AGS and Aerospike DB](https://aerospike.com/docs/graph/manage/security/tls/tls-ags-asdb/)

## Auditing

AGS can log user actions for compliance and incident investigation. Audit logs capture write, delete, and call step operations, so you have a record of who changed what and when.

Compliance logging

Record graph mutations and call steps.

[Audit logging](https://aerospike.com/docs/graph/manage/security/audit/)

::: note
Audit logging requires [RBAC for AGS](https://aerospike.com/docs/graph/manage/security/rbac-graph/) to be enabled. Without RBAC, there is no user identity to associate with logged operations.
:::