Security, access and tenancy
Every request passes several independent checks before it reaches a record.
Layers of access#
- Workspace: You must be a member of the workspace. Admins can see every workspace.
- Role: Viewer, operator, approver, contributor or admin. Any action not listed for a role is refused.
- Object: Nothing is visible until an admin grants it: read or write per class, for each person or credential.
- Record (basic RLS): A person sees only the records they own. This is on by default for Account, Contact, Opportunity, Lead and Case, matched on the owner's email. Admins see every record.
- Row and field policies (advanced RLS + CLS): Allow or deny rules on rows; fields shown, masked or hidden. Pilot, off by default.
Tenant isolation#
| Store | How workspaces are kept apart |
|---|---|
| Metadata database (PostgreSQL) | Row-level security on every workspace table. Shared tables are listed with a reason, and a build check fails if any table is missed. |
| Knowledge fabric (Fuseki) | Each workspace has its own graphs. |
| Record store (Neo4j) | Every record carries its workspace. |
| Search index and document graph | One collection and one graph per workspace. |
Roles#
| Role | Can |
|---|---|
| Viewer | Read |
| Operator | Start and advance mappings, run insights |
| Approver | Approve or stop mapping gates |
| Contributor | Start mappings, decide gates, write data |
| Admin | Settings, users, credentials, merges and deletes |
Advanced row and field policies#
This is a pilot, off by default. Admins write policies that decide which rows a person sees and how each field appears: clear, masked or hidden. Deny always wins, and a field nobody has classified is hidden. Each policy is tested on sample records and approved by a second admin before it applies.
Policies cover reading today; write and export policies are planned. While a workspace uses policies, features that cannot yet apply field rules are switched off there: graph views, forms, exports, change-event details, AI-generated output, user edits and aggregation queries.
Sign-in#
- Passwords need at least 12 characters, with upper and lower case letters, a digit and a symbol.
- Repeated wrong passwords make each next attempt wait longer, and sign-in attempts are rate limited. Accounts are not locked.
- Console sessions end after 30 minutes without activity, and 8 hours after sign-in at most.
- Single sign-on through Keycloak, alone or alongside local accounts.
- MetaFabric is its own OAuth server for AI assistants and apps.
Audit#
Changes, approvals, refused requests and AI assistant calls are logged, and refused requests are kept for 90 days. Audit and approval records cannot be edited.