The shop floor, the head office, the group structure, and everyone outside who needs in.
CAD and PLM hold the designs. The MES runs the line, the QMS holds the quality record, and SAP or your ERP holds the cost of all of it. Some of that lives on a shop floor where machines are shared and the network comes and goes. Some lives in a head office that looks like any other head office. Some belongs to a group where each plant is its own legal entity. And a good deal of it is reached by people who do not work for you.

Factory work runs to a schedule, on site. That makes contextual controls close to absolute rather than a compromise: access to the MES, the QMS and the ERP only inside the hours that role works, and only from inside the facility network. An attempt on a holiday, or from a hotel, is refused. In an office those rules cost you flexibility you need. On a shop floor they cost you nothing.
Terminals shared across a shift need the decision at sign-in rather than at setup, which is where single sign-on and a passwordless factor earn their place.

Finance, procurement, HR and sales run the applications every business runs, and they hold the payment authorisations and the salary data. They get the same treatment as the plant: entitlements from role, MFA that escalates when a request looks wrong, and provisioning that reaches SAP and the CRM rather than stopping at the directory. Contract labour alongside salaried staff makes the leaver case constant rather than occasional.

Designs, tooling data, process specifications and supplier terms are what a competitor would want, and they leave on a stick or in an attachment. Akku indexes your own files as fingerprints, so a protected drawing is caught as a byte-identical copy however it reached the machine, by network share, download or USB. Removable media is allowed or denied by device, or left available with the file content deciding what goes onto it. Print, clipboard and screenshot are covered too.

Group structures put plants and subsidiaries under separate entities that share systems, services and people. Access has to respect the boundary while the shared services team crosses it. Akku scopes access, policy and delegated administration by organisation, so a plant administrator runs their own estate and the group sees all of them, instead of four directories disagreeing about who works where.

Commissioning engineers, integrators and maintenance contractors get access from a role with a window that expires on its own. Where they need a machine, a historian or a server directly, the session runs through a proxy: the credential generated for that session, revoked at its close, the screen and every command recorded. Vendors and customers reaching your systems for orders or quality documents come in through federation rather than an account somebody creates and forgets.

Policies keep applying with no connection to head office, from a signature-verified bundle cached on each machine. Findings queue locally and sync when it returns.

Manufacturing rarely has a regulator specifying controls and frequently has customers who do. Automotive and pharmaceutical supply chains pass obligations down by contract, and ISO 27001 gets required because a customer requires it. Akku covers 56 of the 93 Annex A controls and holds the certification itself. DPDPA applies to the employee and customer data you hold whoever else is asking.
