Overview
Enclave uses fixed system roles. Permissions are defined by role and cannot be customised per user. Every user in the organisation has exactly one role, which determines their access scope across the platform. Roles are assigned at invite time and can be changed by an Owner (or Org Admin within their scope) at Organisation → Users.Roles
Permissions matrix
Green = full access · Blue = scoped access (see notes) · — = no accessScoped access notes
Security Officers have no file access by design. This enforces separation of duties — the person who can view all audit events and manage encryption keys cannot also read file contents. This is an ISO 27001 A.6.1.2 control.
Default clearance by role
Each role carries a default clearance level. Individual users can be overridden above or below this default at Organisation → Users → Set Clearance.
See Clearance Levels for how clearance interacts with file classification and DLP policies.
Org unit roles
In addition to their organisation-wide role, users can hold a membership role within each org unit they belong to. These are independent of the system role above.
Membership roles are set per-unit at Organisation → Users → Manage memberships. A Member with organisation-wide role “Member” can hold Manager-level access in one unit and Viewer-level access in another.
Owner and Org Admin roles do not grant implicit file access to org units. Admins must hold explicit membership in an org unit to access files in rooms owned by that unit.