> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kvelden.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Clearance Levels

> Classification-based access control — users need both room membership and sufficient clearance.

## How clearance works

Clearance adds a second access gate orthogonal to room membership. Even if a user is a member of a room, they cannot access a file whose classification exceeds their effective clearance.

```
User can access file if:
  user.org_unit_membership = room.org_unit  AND
  user.room_membership EXISTS              AND
  user.effective_clearance >= file.classification
```

## Classification levels

| Level | Label              | Description                                                     |
| ----- | ------------------ | --------------------------------------------------------------- |
| C1    | Public sensitivity | Accessible to any authenticated user                            |
| C2    | Internal           | Standard internal documents                                     |
| C3    | Confidential       | Sensitive business data                                         |
| C4    | Restricted         | Highest sensitivity — board materials, cryptographic keys, M\&A |

## Effective clearance

Clearance is **decoupled from role**. A user's effective clearance is their explicit
level, or **C1 (public)** if none has been assigned:

```
effective_clearance = explicit_clearance  (or C1 if unset)
```

This separates two concerns cleanly:

* **Role** (RBAC) governs *what a user can do* — and *who may set clearance*.
* **Clearance** (MAC) governs *what data sensitivity a user may access*.

New users start at **C1 by default** (least privilege) and must be explicitly
granted a higher level to read internal (C2) or more sensitive files. This
applies to **every** account regardless of how it was provisioned — local
signup, email invite, **SSO**, or **directory (LDAP/AD)** — so a first sign-in
never grants more than public access until an administrator elevates it.

<Note>
  When this model was introduced, every **existing** user was backfilled to
  preserve their previous access (e.g. members to C2, admins to C4), so no one
  lost access on upgrade. Only newly created users start at C1.
</Note>

An explicit level sets access **exactly** — it can raise *or* lower a user's
reach. Only an **Owner**, **Org Admin**, **Unit Admin**, or **Security Officer**
may set it.

## Setting clearance

1. Navigate to **Organisation → Users**
2. Click a user → **Set Clearance**
3. Select a level (or choose **Default (C1)** to remove the override)
4. Click **Save**

The change takes effect immediately. The event is recorded in the audit log.

## Where clearance is enforced

The clearance check runs on **every read of decrypted content**, so membership
alone never grants access above a user's level:

* Viewing or downloading a file in **My Files**, a **shared file/folder**, or a **secure room**
* Restoring or downloading a **file version**
* Previewing a file as an **approver** in an approval workflow
* **External (federated) downloads** — an invitation carries a *clearance ceiling*
  the guest cannot exceed (see [Sharing Policies](/enclave/sharing-policies))
* **Room membership grants** — joining a classified room requires clearance at or
  above the room's floor (Internal → C2, Confidential → C3, Restricted → C4), and
  external invitation ceilings for that room are floored the same way

For zero-knowledge rooms the server holds no plaintext, so clearance is enforced
as a **label check** on the file's classification rather than a content scan.

## Clearance matrix

The **Clearance Matrix** view (**Organisation → Clearance Matrix**) shows all users and their effective clearance in a single table — useful for access reviews and auditor evidence.

## File classification at upload

When uploading a file, contributors can set the classification. If not set, the room's default classification is used. Room owners set the default during room creation.

<Warning>
  Downgrading a file's classification (e.g. C4 → C2) is a sensitive action. It is logged and requires the acting user to have clearance ≥ the original classification.
</Warning>