Skip to main content

​
How clearance works

Clearance adds a second access gate orthogonal to room membership. Even if a user is a member of a room, they cannot access a file whose classification exceeds their effective clearance.

​
Classification levels

​
Effective clearance

Clearance is decoupled from role. A user’s effective clearance is their explicit level, or C1 (public) if none has been assigned:
This separates two concerns cleanly:
  • Role (RBAC) governs what a user can do — and who may set clearance.
  • Clearance (MAC) governs what data sensitivity a user may access.
New users start at C1 by default (least privilege) and must be explicitly granted a higher level to read internal (C2) or more sensitive files. This applies to every account regardless of how it was provisioned — local signup, email invite, SSO, or directory (LDAP/AD) — so a first sign-in never grants more than public access until an administrator elevates it.
When this model was introduced, every existing user was backfilled to preserve their previous access (e.g. members to C2, admins to C4), so no one lost access on upgrade. Only newly created users start at C1.
An explicit level sets access exactly — it can raise or lower a user’s reach. Only an Owner, Org Admin, Unit Admin, or Security Officer may set it.

​
Setting clearance

  1. Navigate to Organisation → Users
  2. Click a user → Set Clearance
  3. Select a level (or choose Default (C1) to remove the override)
  4. Click Save
The change takes effect immediately. The event is recorded in the audit log.

​
Where clearance is enforced

The clearance check runs on every read of decrypted content, so membership alone never grants access above a user’s level:
  • Viewing or downloading a file in My Files, a shared file/folder, or a secure room
  • Restoring or downloading a file version
  • Previewing a file as an approver in an approval workflow
  • External (federated) downloads — an invitation carries a clearance ceiling the guest cannot exceed (see Sharing Policies)
  • Room membership grants — joining a classified room requires clearance at or above the room’s floor (Internal → C2, Confidential → C3, Restricted → C4), and external invitation ceilings for that room are floored the same way
For zero-knowledge rooms the server holds no plaintext, so clearance is enforced as a label check on the file’s classification rather than a content scan.

​
Clearance matrix

The Clearance Matrix view (Organisation → Clearance Matrix) shows all users and their effective clearance in a single table — useful for access reviews and auditor evidence.

​
File classification at upload

When uploading a file, contributors can set the classification. If not set, the room’s default classification is used. Room owners set the default during room creation.
Downgrading a file’s classification (e.g. C4 → C2) is a sensitive action. It is logged and requires the acting user to have clearance ≥ the original classification.