> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kvelden.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Access Control

> Role-based and attribute-based access control in Enclave — membership, clearance, and sharing policies.

## Access control model

Enclave uses a layered model. A user must satisfy **all** of the following to access a file:

1. **Authentication** — valid session token
2. **Org Unit membership** — member of the Org Unit that owns the room (explicit; not inherited from role)
3. **Room membership** — explicitly added to the room with a role
4. **Clearance level** — effective clearance ≥ file classification

Failing any layer denies access. There is no override or bypass path — including for Owner and Org Admin roles.

## Organisation roles

| Role                 | Description                                                                     |
| -------------------- | ------------------------------------------------------------------------------- |
| **Owner**            | Full control of the organisation, all rooms, all users — max 3 per organisation |
| **Org Admin**        | Manages an org unit subtree and all users within it                             |
| **Unit Admin**       | Manages a single assigned Org Unit                                              |
| **Security Officer** | Security configuration and audit logs only — no file access (ISO 27001 A.6.1.2) |
| **Member**           | Regular user — access determined by Org Unit and room membership                |
| **Auditor**          | Read-only compliance reports and audit logs — no file access                    |

## Org Unit membership

Org Units gate which rooms a user can be a member of. A user without Org Unit membership cannot be added to any room that Org Unit owns.

Key properties:

* Adding a user to an Org Unit does **not** automatically grant them room access — room membership is a separate, explicit grant
* Users can belong to **multiple** Org Units simultaneously
* Admin roles do **not** grant implicit file access — admins still need explicit Org Unit membership for file access
* Sharing to a parent Org Unit propagates **downward** to members of child units; sharing to a child does **not** propagate upward

## Room roles

Within a room, members have one of three roles:

| Role        | Download | Upload | Rename / Delete files | Manage members |
| ----------- | -------- | ------ | --------------------- | -------------- |
| Owner       | ✓        | ✓      | ✓                     | ✓              |
| Contributor | ✓        | ✓      | —                     | —              |
| Viewer      | ✓        | —      | —                     | —              |

External guests invited to a room follow the same Viewer/Contributor semantics, with three extra gates: the room's **Allow external guest uploads** policy must be enabled, the guest's invitation must carry the per-invitee **upload grant**, and every external upload is held for room-admin approval before other members can see it. See [Rooms → External guest access](/enclave/rooms#external-guest-access).

## Clearance levels

Files carry a classification (C1–C4). Users carry a clearance level. Access is granted only when `user clearance ≥ file classification`.

| Classification | Label              | Minimum clearance                          |
| -------------- | ------------------ | ------------------------------------------ |
| C1             | Public sensitivity | Any authenticated user                     |
| C2             | Internal           | C2 (default for Members and Auditors)      |
| C3             | Confidential       | C3 (Unit Admins by default)                |
| C4             | Restricted         | C4 (Owners, Org Admins, Security Officers) |

Clearance can be overridden per user in **Organisation → Users → Set Clearance**.

## Data sharing policies

Administrators control which classification levels can be shared, and to which targets (tenant, org unit, user). Policy is set in **Security → Policies → Data Sharing**.

The policy evaluates three levels in order — each can only add restrictions, never loosen them:

1. **Tenant policy** — master on/off switch for all internal and external sharing
2. **Classification policy** — per-level (C1–C4) rules: block by target type, require expiry, require PIN
3. **Per-type rules** — additional restrictions per Org Unit type label (e.g. block sharing to "Domain" units at C3)

[Full sharing policy reference →](/enclave/sharing-policies)

## Access reviews

Org Unit memberships can be periodically reviewed through an **Access Review** campaign:

1. An admin starts a review — Enclave snapshots all current memberships
2. Each membership is marked as pending
3. Reviewers approve (keep) or revoke each membership
4. Revoked memberships are removed immediately
5. The review is closed — remaining pending entries are auto-approved

Access reviews produce a signed audit record suitable for SOC 2 and ISO 27001 evidence. Start one from **Organisation → Access Reviews** or **Security → Policies → Access Reviews**.

[Organisation overview →](/organization/overview)

## Security alerts

Enclave's alerting engine monitors both specific audit actions (policy alerts) and user file-access patterns (behavioral anomaly detection). Alerts notify Owners and Security Officers in real time via in-app notification, email, and Slack.

[Security Alerts →](/enclave/security-alerts)