Skip to main content

​
Access control model

Enclave uses a layered model. A user must satisfy all of the following to access a file:
  1. Authentication — valid session token
  2. Org Unit membership — member of the Org Unit that owns the room (explicit; not inherited from role)
  3. Room membership — explicitly added to the room with a role
  4. Clearance level — effective clearance ≥ file classification
Failing any layer denies access. There is no override or bypass path — including for Owner and Org Admin roles.

​
Organisation roles

​
Org Unit membership

Org Units gate which rooms a user can be a member of. A user without Org Unit membership cannot be added to any room that Org Unit owns. Key properties:
  • Adding a user to an Org Unit does not automatically grant them room access — room membership is a separate, explicit grant
  • Users can belong to multiple Org Units simultaneously
  • Admin roles do not grant implicit file access — admins still need explicit Org Unit membership for file access
  • Sharing to a parent Org Unit propagates downward to members of child units; sharing to a child does not propagate upward

​
Room roles

Within a room, members have one of three roles: External guests invited to a room follow the same Viewer/Contributor semantics, with three extra gates: the room’s Allow external guest uploads policy must be enabled, the guest’s invitation must carry the per-invitee upload grant, and every external upload is held for room-admin approval before other members can see it. See Rooms → External guest access.

​
Clearance levels

Files carry a classification (C1–C4). Users carry a clearance level. Access is granted only when user clearance ≥ file classification. Clearance can be overridden per user in Organisation → Users → Set Clearance.

​
Data sharing policies

Administrators control which classification levels can be shared, and to which targets (tenant, org unit, user). Policy is set in Security → Policies → Data Sharing. The policy evaluates three levels in order — each can only add restrictions, never loosen them:
  1. Tenant policy — master on/off switch for all internal and external sharing
  2. Classification policy — per-level (C1–C4) rules: block by target type, require expiry, require PIN
  3. Per-type rules — additional restrictions per Org Unit type label (e.g. block sharing to “Domain” units at C3)
Full sharing policy reference →

​
Access reviews

Org Unit memberships can be periodically reviewed through an Access Review campaign:
  1. An admin starts a review — Enclave snapshots all current memberships
  2. Each membership is marked as pending
  3. Reviewers approve (keep) or revoke each membership
  4. Revoked memberships are removed immediately
  5. The review is closed — remaining pending entries are auto-approved
Access reviews produce a signed audit record suitable for SOC 2 and ISO 27001 evidence. Start one from Organisation → Access Reviews or Security → Policies → Access Reviews. Organisation overview →

​
Security alerts

Enclave’s alerting engine monitors both specific audit actions (policy alerts) and user file-access patterns (behavioral anomaly detection). Alerts notify Owners and Security Officers in real time via in-app notification, email, and Slack. Security Alerts →