CONNEXION

Connexion sécurisée en cours…

Nous préparons votre essai Apsolu Pro. Vous pouvez revenir à l’accueil à tout moment.

Trust & Security

Permissions & Access Control

Last updated: May 19, 2026 — Ref: TRUST-004 — Audit Q16 & Q17

APSOLU Pro implements a two-layer Role-Based Access Control (RBAC) model. The first layer operates at the organization level via Clerk authentication. The second layer provides granular, per-project membership control stored in the application database. No authenticated user can access data belonging to another organization — all queries are org-scoped at the database level.

Layer 1 — Organization Roles (Clerk)

Every APSOLU Pro user authenticates via Clerk and belongs to an organization. Clerk assigns one of two organization-level roles:

org:adminOrganization Admin

Invite and remove organization members
Assign and change Clerk organization roles
Access all projects in the organization (Clerk fallback)
Manage billing and subscription
Configure organization-wide settings
Manage catalog (phases, lots, roles, statuses)
Create and delete projects

org:memberOrganization Member

Access only projects where explicitly invited
View shared catalog (read-only)
No billing or organization settings access
No ability to create projects

Clerk fallback rule: An org:admin is automatically granted access to all projects in the organization, even without an explicit project membership row. This prevents administrative lockout when the project membership table is sparse. All other users require an explicit project invitation.

Layer 2 — Project Roles (Database)

Within each project, users are assigned one of five granular roles stored in the project_members table. These roles control read/write access to specific project features.

Role	Profile	Typical user
OWNER	Full control — delete, transfer, manage all members	Founding project manager, org admin designated as project lead
ADMIN	Full write access + member management, cannot delete project	Deputy PM, senior project coordinator
MANAGER	Operational access including financial data, no team management	Quantity Surveyor, lead architect, external PM consultant
EDITOR	Contribute actions and documents, no financial or team access	Site supervisor, subcontractor lead, technician
VIEWER	Read-only across project content, no financial data	Client representative, investor, external observer

Role promotion rule:A user’s role can only be upgraded, never silently downgraded. Re-inviting an OWNER with a lower role has no effect — the higher role is always preserved.

Feature Matrix — Project Roles

The table below details which actions are available per project role. Org admins (org:admin) always have full access equivalent to OWNER via the Clerk fallback.

Feature	OWNER	ADMIN	MANAGER	EDITOR	VIEWER
Project administration
Delete project	Yes	No	No	No	No
Transfer ownership	Yes	No	No	No	No
Project settings	Yes	Yes	No	No	No
Manage project members (invite / remove)	Yes	Yes	No	No	No
Dashboard & visibility
Today cockpit / daily dashboard	Yes	Yes	Yes	Yes	Read
Project dashboard	Yes	Yes	Yes	Yes	Read
Actions
View actions	Yes	Yes	Yes	Yes	Read
Create / edit actions	Yes	Yes	Yes	Yes	No
Delete actions	Yes	Yes	Yes	No	No
Documents (Inbox)
View documents	Yes	Yes	Yes	Yes	Read
Upload documents	Yes	Yes	Yes	Yes	No
Delete documents	Yes	Yes	Yes	No	No
Journal (CRR / Meeting Minutes)
View CRRs	Yes	Yes	Yes	Yes	Read
Create / edit CRRs	Yes	Yes	Yes	Yes	No
Publish CRR	Yes	Yes	Yes	No	No
Programme (Planning)
View programme (Gantt, calendar)	Yes	Yes	Yes	Yes	Read
Edit tasks, milestones, sequences	Yes	Yes	Yes	No	No
Import programme via AI	Yes	Yes	Yes	No	No
Financial data (Q16)
View budget	Yes	Yes	Read	No	No
Edit budget	Yes	Yes	No	No	No
View cashflow	Yes	Yes	Read	No	No
Edit cashflow	Yes	Yes	No	No	No
Contacts & Companies
View contacts / companies	Yes	Yes	Yes	Read	No
Create / edit contacts	Yes	Yes	Yes	No	No
Pro-Snags (Site Inspection)
View inspections	Yes	Yes	Yes	Yes	Read
Create / edit snags, upload photos	Yes	Yes	Yes	Yes	No
AI features
AI document analysis / extraction	Yes	Yes	Yes	Yes	No
Email → Actions (AI)	Yes	Yes	Yes	Yes	No
Knowledge base search	Yes	Yes	Yes	Yes	Read

Yes= full read/write | Read= view only | No = access denied

Scenario — Quantity Surveyor (QS) vs Project Manager (PM)

This scenario directly addresses audit questions Q16 (financial data visibility control) and Q17 (external consultant access scoping).

Project Manager (PM)

Internal — full project authority

OWNER or ADMINorg:admin or org:member

All project features without restriction
Budget, cashflow, and financial projections
Manage project team (invite, remove, change roles)
Create and validate CRRs (Meeting Minutes)
Delete project or transfer ownership
Edit programme and milestones

Quantity Surveyor (QS)

External consultant — scoped access

MANAGERorg:member

View and edit budget / cashflow data (Q16 answer)
View and edit programme (Gantt, tasks, sequences)
View all documents and actions
Cannot manage project team membership
Cannot delete the project or change project settings
Cannot access other projects in the organization (Q17 answer)

External Contractor / Subcontractor

Limited read + operational input

EDITORorg:member

Create and update actions assigned to them
Upload documents (photos, reports, delivery slips)
View programme and dashboard
No access to budget or cashflow
No access to other projects
Read-only on contacts and company data

Client / Observer

Stakeholder read-only visibility

VIEWERorg:member

View dashboard, today cockpit, and programme
View actions (read-only)
View published CRRs and documents
No create, edit, or delete on any resource
No financial data access
No access to contacts or project settings

Managing Users — Platform Interface

Organization administrators manage team members directly from within APSOLU Pro. No external dashboard or support ticket is required.

Organization members (Clerk level)

Go to Organization in the left sidebar (/organization). Use the Clerk widget to invite users by email, assign them the org:admin or org:member Clerk role, and remove members at any time. Changes take effect immediately.

Project invitations (project level)

Inside any project, go to Setup → Intervenants (/projects/[id]/setup/intervenants). Invite a user to the project and assign their project role (OWNER / ADMIN / MANAGER / EDITOR / VIEWER). Invitations are token-based with configurable expiry.

Revoking access

Removing a user from the project_members table immediately revokes their project access. Removing them from the Clerk organization revokes all access to APSOLU Pro across all projects for that organization.

Audit trail: All membership changes (invite, role change, revoke) are recorded with a timestamp and the acting user ID. Contact security@apsolu.app to request an access log export for your organization.

Technical Implementation

For security professionals and technical auditors:

Org isolation: Every database query is scoped by orgId derived from the Clerk JWT. Cross-org data access is structurally impossible — there is no query path that returns rows from another organization.
Authentication provider: Clerk (clerk.com) — SOC 2 Type II compliant, optional MFA/2FA, passwordless options supported.
Session validation: Clerk JWTs are verified on every API request using a cached public key (CLERK_JWT_KEY env var) to avoid network round-trips on Edge cold starts.
API authorization: All authenticated API routes call getOrgIdOrThrow() as the first guard. Admin routes additionally call requireOrgAdmin() which checks session.orgRole === "org:admin".
Rate limiting: API routes: 100 req/min per IP. AI routes: 20 req/min per IP. Enforced at the Edge middleware layer.
Transport security: TLS 1.3 enforced. HSTS enabled via Vercel. Content-Security-Policy active (report-only + enforced frame-ancestors).
Data at rest: PostgreSQL hosted on Supabase (Frankfurt, EU). Files stored on Cloudflare R2 (EU region). Encryption at rest enabled by default on both providers.

Questions about access control? security@apsolu.app