> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kvelden.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Organisation Overview

> Managing your Kvelden Enclave organisation — users, Org Units, policies, and access reviews.

## Organisation structure

```
Organisation (tenant)
├── Org Unit: Legal (Domain)
│   ├── Room: M&A Deal Room Q1
│   └── Room: NDA Repository
├── Org Unit: Engineering (Domain)
│   ├── Org Unit: Backend (Team)
│   └── Org Unit: Frontend (Team)
│       └── Room: Source Code Secrets
└── Org Unit: Finance (Domain)
    └── Room: Board Materials
```

Your organisation is the top-level tenant. Within it you create **Org Units** that mirror your team structure — each with a free-text **type label** (Domain, Team, Department, Squad, etc.) that is display-only and does not affect access control.

Users can belong to **multiple** Org Units. Each membership is explicit — there is no implicit access from hierarchy or admin roles.

## Admin roles

| Role             | Scope                                                             |
| ---------------- | ----------------------------------------------------------------- |
| Owner            | Full tenant control — up to 3 per organisation                    |
| Org Admin        | Manages an org unit subtree and all users within it               |
| Unit Admin       | Manages a single assigned Org Unit                                |
| Security Officer | Security configuration and audit logs only — no file access       |
| Auditor          | Read-only compliance reports and audit logs — no file access      |
| Member           | Standard user — access determined by Org Unit and room membership |

## Security policies

Security officers and owners configure organisation-wide policies from **Security → Policies**:

| Policy area          | What it controls                                                                |
| -------------------- | ------------------------------------------------------------------------------- |
| **Data Sharing**     | Which classification levels can be shared, and to whom (tenant, org unit, user) |
| **Encryption**       | Which KMS key is used per org unit scope                                        |
| **Storage**          | Which storage backend is assigned per org unit scope                            |
| **DLP**              | Content-scanning rules that trigger on upload                                   |
| **Org Unit Roster**  | Audit view of all user–org unit memberships                                     |
| **Clearance Matrix** | User effective clearance at a glance                                            |

## Access reviews

Access reviews are periodic certification workflows. An admin starts a review, which snapshots all current Org Unit memberships. Each membership is approved (kept) or revoked by a reviewer. Revoked memberships are removed immediately.

Access reviews satisfy ISO 27001 Annex A.9 and SOC 2 CC6.2 requirements for periodic access certification.

[View full access control docs →](/enclave/access-control)