Access and audit
Because protected data is treated as present across the platform, the access and audit controls are what make minimum-necessary access real. This page describes those controls as design intent.
Role-based access
Access is scoped to roles, and roles map to least privilege.
- A role grants the minimum needed for the job. Broad access is the exception and is itself recorded.
- Each person, agent, and process gets only the data its specific task needs. No one holds a standing grant to all protected data.
- Machine identities follow the same least-privilege rule, since a leaked machine credential is a common failure mode.
See Roles and access for the roles in the product.
Project-scoped access
Beyond roles, access can be narrowed to a project, which is private to its owner by default and can be shared within your organization. This lets teams keep work and reference files scoped to the people who need them.
Tenant isolation
The platform is multi-tenant, and isolation between organizations operates at more than one layer.
The isolation is designed to survive joint arrangements, so two operators partnering on a contract can each keep their own data isolated. Audit history is scoped per organization, so each organization reviews its own access.
Append-only audit logging
Every access to a protected record is designed to produce an audit entry, and those entries are append-only.
- Append-only and immutable. Entries can be written and read, not edited or deleted, so the trail is tamper-evident and survives even a person with broad access.
- Attributed and timestamped. Each entry records who acted, what they acted on, and when.
- References, not values. An entry records that a record was accessed, never the protected value (see Data handling).
- Exportable. The trail can be exported for review and investigation, which supports access-tracking obligations.
How the controls work together
The controls layer to keep access minimum-necessary and reviewable:
- Role-based access decides who can reach a protected record at all.
- Tenant isolation decides which records they can reach within their own organization.
- Append-only audit logging records every access that does happen, so the first two are reviewable rather than assumed.
See also
- Audit and usage for reading the audit log in the product.
- Data handling for the logging rule.
Data handling
How data is classified, why some trip-linked identifiers count as protected, what is logged, and how sensitive fields are protected.
AI and PHI
How AI features handle protected data: minimum-necessary and query-scoped, grounded in the operator's own authorized view, and run inside the same compliant cloud.