Layers of access
1
A verified person
The request must carry a valid sign-in token. See Authentication.
2
An active organization
The token names the organization the person is working in, along with their role there. Both come from the identity provider, which is the system of record for memberships.
3
The right role
Administrative operations require the Admin role: inviting and removing members, changing roles, billing, organization settings, agent inbox configuration, and sharing templates with the organization.
4
Entitlement
Casa Conect OS features (the agent, matters, the editor and the agent inbox) additionally require that the organization has the product enabled and a subscription in good standing.
5
The resource itself
Finally the specific record is checked: is this person a member of the project? Can they see this matter? Do they hold a permission on this document type in this Shared Space?
Roles
Casa Conect has two organization roles. For a full breakdown, see Roles and permissions.Scopes of content
Tenant isolation
Casa Conect is a multi-tenant service. Customers share infrastructure, and isolation is enforced in software at several independent layers:- Every data operation is scoped by the organization and user taken from the verified token. There is no code path in which a client supplies an organization identifier and is simply believed.
- The database schema itself enforces tenancy. Records are tied to their organization in a way the database refuses to violate, even if application code contained a bug.
- Search resolves access before it searches. Document search first works out exactly which documents the person may read, and only then runs the search inside that set. See Search.
- Files are private by default. Storage is never public, and every file access goes through a short-lived signed link issued after an authorization check.
The agent’s access
The agent has no access of its own. A session acts as the specific person who started it, with that person’s role and project memberships. Every tool call passes through the same authorization as a click in the interface. For email from a verified member, the agent acts as that member. For an allowed external sender, it acts as the organization’s agent with a deliberately small set of abilities. See Agent safety.Public share pages
Share links give outside parties narrow access without an account. A recipient is authenticated by their share session, not as a user, and that session grants nothing beyond the one link. Share pages have their own rate limits, and PIN attempts are refused outright if the limiter is unavailable.What admins can and cannot see
Organization admins can see and manage every project in the organization, including private ones, along with the matters and shared conversations inside them. This lets an admin step in when a colleague is away or leaves. Admins cannot open a member’s personal vault or a member’s private conversations with the agent. Those belong to the individual.This page describes our security practices at the level of a help page. We share detailed security documentation, architecture reviews and completed questionnaires with customers on request. Write to support@casaconect.ai.