Permissions
Target permissioning for multi-organization work.
Permissions
The current repository has Better Auth identity and organization tables. It does not yet implement relationship-scoped permissions, external participants, field policies, document policies, or workstream visibility.
Target boundaries#
| Boundary | Example |
|---|---|
| Organization | Customer users can see their own implementation portal, not another customer's portal |
| Relationship | A vendor manager can access one vendor relationship, not all vendor records |
| Workstream | Customer security can see security review tasks, not pricing approval notes |
| Channel | A chat channel can sync to one workstream without exposing the entire account timeline |
| Document | A DPA can be shared with legal while pricing files remain internal |
| Field | External users can see target launch date but not internal health rationale |
| Action | A customer can upload a file and comment, but cannot approve an internal exception |
Target participant types#
- Internal user: employee of the company using Arn.
- External participant: customer, vendor, partner, auditor, consultant, or service provider.
- Service account: integration identity for systems, channels, or bots.
- Guest reviewer: time-bound access for legal, security, procurement, or executive review.
Target visibility states#
| State | Behavior |
|---|---|
| Internal | visible only to internal users with access to the relationship |
| Shared | visible to approved external participants in the relevant portal or channel |
| Restricted | visible only to named users, teams, or roles |
| Redacted | visible as metadata, with sensitive content hidden |
| Pending approval | hidden externally until an authorized owner approves release |
Target sync rules#
Permissions must apply before data moves:
- Do not sync internal notes to external channels.
- Do not write inferred contract terms into a system without approval.
- Do not expose cross-customer vendor performance data to a single customer.
- Do not include restricted files in generated summaries for unauthorized users.
- Do not let external users discover internal-only records through search.
Current status#
Relationship-scoped RBAC, field policies, document policies, approval gates, audit logs for relationship actions, and permission-aware AI retrieval are not implemented yet.