Permissions & Access Control
Last updated: May 19, 2026 — Ref: TRUST-004 — Audit Q16 & Q17
APSOLU Pro implements a two-layer Role-Based Access Control (RBAC) model. The first layer operates at the organization level via Clerk authentication. The second layer provides granular, per-project membership control stored in the application database. No authenticated user can access data belonging to another organization — all queries are org-scoped at the database level.
Layer 1 — Organization Roles (Clerk)
Every APSOLU Pro user authenticates via Clerk and belongs to an organization. Clerk assigns one of two organization-level roles:
- Invite and remove organization members
- Assign and change Clerk organization roles
- Access all projects in the organization (Clerk fallback)
- Manage billing and subscription
- Configure organization-wide settings
- Manage catalog (phases, lots, roles, statuses)
- Create and delete projects
- Access only projects where explicitly invited
- View shared catalog (read-only)
- No billing or organization settings access
- No ability to create projects
org:admin is automatically granted access to all projects in the organization, even without an explicit project membership row. This prevents administrative lockout when the project membership table is sparse. All other users require an explicit project invitation.Layer 2 — Project Roles (Database)
Within each project, users are assigned one of five granular roles stored in the project_members table. These roles control read/write access to specific project features.
| Role | Profile | Typical user |
|---|---|---|
| OWNER | Full control — delete, transfer, manage all members | Founding project manager, org admin designated as project lead |
| ADMIN | Full write access + member management, cannot delete project | Deputy PM, senior project coordinator |
| MANAGER | Operational access including financial data, no team management | Quantity Surveyor, lead architect, external PM consultant |
| EDITOR | Contribute actions and documents, no financial or team access | Site supervisor, subcontractor lead, technician |
| VIEWER | Read-only across project content, no financial data | Client representative, investor, external observer |
OWNER with a lower role has no effect — the higher role is always preserved.Feature Matrix — Project Roles
The table below details which actions are available per project role. Org admins (org:admin) always have full access equivalent to OWNER via the Clerk fallback.
| Feature | OWNER | ADMIN | MANAGER | EDITOR | VIEWER |
|---|---|---|---|---|---|
| Project administration | |||||
| Delete project | Yes | No | No | No | No |
| Transfer ownership | Yes | No | No | No | No |
| Project settings | Yes | Yes | No | No | No |
| Manage project members (invite / remove) | Yes | Yes | No | No | No |
| Dashboard & visibility | |||||
| Today cockpit / daily dashboard | Yes | Yes | Yes | Yes | Read |
| Project dashboard | Yes | Yes | Yes | Yes | Read |
| Actions | |||||
| View actions | Yes | Yes | Yes | Yes | Read |
| Create / edit actions | Yes | Yes | Yes | Yes | No |
| Delete actions | Yes | Yes | Yes | No | No |
| Documents (Inbox) | |||||
| View documents | Yes | Yes | Yes | Yes | Read |
| Upload documents | Yes | Yes | Yes | Yes | No |
| Delete documents | Yes | Yes | Yes | No | No |
| Journal (CRR / Meeting Minutes) | |||||
| View CRRs | Yes | Yes | Yes | Yes | Read |
| Create / edit CRRs | Yes | Yes | Yes | Yes | No |
| Publish CRR | Yes | Yes | Yes | No | No |
| Programme (Planning) | |||||
| View programme (Gantt, calendar) | Yes | Yes | Yes | Yes | Read |
| Edit tasks, milestones, sequences | Yes | Yes | Yes | No | No |
| Import programme via AI | Yes | Yes | Yes | No | No |
| Financial data (Q16) | |||||
| View budget | Yes | Yes | Read | No | No |
| Edit budget | Yes | Yes | No | No | No |
| View cashflow | Yes | Yes | Read | No | No |
| Edit cashflow | Yes | Yes | No | No | No |
| Contacts & Companies | |||||
| View contacts / companies | Yes | Yes | Yes | Read | No |
| Create / edit contacts | Yes | Yes | Yes | No | No |
| Pro-Snags (Site Inspection) | |||||
| View inspections | Yes | Yes | Yes | Yes | Read |
| Create / edit snags, upload photos | Yes | Yes | Yes | Yes | No |
| AI features | |||||
| AI document analysis / extraction | Yes | Yes | Yes | Yes | No |
| Email → Actions (AI) | Yes | Yes | Yes | Yes | No |
| Knowledge base search | Yes | Yes | Yes | Yes | Read |
Yes= full read/write | Read= view only | No = access denied
Scenario — Quantity Surveyor (QS) vs Project Manager (PM)
This scenario directly addresses audit questions Q16 (financial data visibility control) and Q17 (external consultant access scoping).
Project Manager (PM)
Internal — full project authority
- All project features without restriction
- Budget, cashflow, and financial projections
- Manage project team (invite, remove, change roles)
- Create and validate CRRs (Meeting Minutes)
- Delete project or transfer ownership
- Edit programme and milestones
Quantity Surveyor (QS)
External consultant — scoped access
- View and edit budget / cashflow data (Q16 answer)
- View and edit programme (Gantt, tasks, sequences)
- View all documents and actions
- Cannot manage project team membership
- Cannot delete the project or change project settings
- Cannot access other projects in the organization (Q17 answer)
External Contractor / Subcontractor
Limited read + operational input
- Create and update actions assigned to them
- Upload documents (photos, reports, delivery slips)
- View programme and dashboard
- No access to budget or cashflow
- No access to other projects
- Read-only on contacts and company data
Client / Observer
Stakeholder read-only visibility
- View dashboard, today cockpit, and programme
- View actions (read-only)
- View published CRRs and documents
- No create, edit, or delete on any resource
- No financial data access
- No access to contacts or project settings
Managing Users — Platform Interface
Organization administrators manage team members directly from within APSOLU Pro. No external dashboard or support ticket is required.
Go to Organization in the left sidebar (/organization). Use the Clerk widget to invite users by email, assign them the org:admin or org:member Clerk role, and remove members at any time. Changes take effect immediately.
Inside any project, go to Setup → Intervenants (/projects/[id]/setup/intervenants). Invite a user to the project and assign their project role (OWNER / ADMIN / MANAGER / EDITOR / VIEWER). Invitations are token-based with configurable expiry.
Removing a user from the project_members table immediately revokes their project access. Removing them from the Clerk organization revokes all access to APSOLU Pro across all projects for that organization.
Technical Implementation
For security professionals and technical auditors:
- Org isolation: Every database query is scoped by
orgIdderived from the Clerk JWT. Cross-org data access is structurally impossible — there is no query path that returns rows from another organization. - Authentication provider: Clerk (clerk.com) — SOC 2 Type II compliant, optional MFA/2FA, passwordless options supported.
- Session validation: Clerk JWTs are verified on every API request using a cached public key (
CLERK_JWT_KEYenv var) to avoid network round-trips on Edge cold starts. - API authorization: All authenticated API routes call
getOrgIdOrThrow()as the first guard. Admin routes additionally callrequireOrgAdmin()which checkssession.orgRole === "org:admin". - Rate limiting: API routes: 100 req/min per IP. AI routes: 20 req/min per IP. Enforced at the Edge middleware layer.
- Transport security: TLS 1.3 enforced. HSTS enabled via Vercel. Content-Security-Policy active (report-only + enforced frame-ancestors).
- Data at rest: PostgreSQL hosted on Supabase (Frankfurt, EU). Files stored on Cloudflare R2 (EU region). Encryption at rest enabled by default on both providers.
Questions about access control? security@apsolu.app