Access Control & Tiers

The Vault uses a tiered access control system to restrict who can view folders and their secrets. This guide explains how the tier system works, how to configure it, and how to use the audit trail to monitor vault activity.

Access Tier System

Every tenant-scoped vault folder is assigned one of three access tiers. These tiers form a strict hierarchy:

The key rule: a user can access a folder only if their effective tier is equal to or higher than the folder's assigned tier. A management-tier user can access Staff and Management folders, but not Director folders.

Personal Folders

Personal vault folders bypass the tier system entirely. They are visible only to their owner, regardless of tier assignments.

Company Folders

Company vault folders follow the same tier rules as tenant folders. A user must have a tier equal to or higher than the folder's tier to access it.

How Your Tier is Determined

Your effective vault tier is resolved in the following order. The first match wins:

1. Per-User Override

An administrator can set a vault tier override directly on your user account. This takes the highest priority. If your account has a vault tier override set to "management", you will have management-level access regardless of your role's permissions.

2. Administrator Status

When no per-user override is set, administrators always receive Director tier access, and this cannot be restricted by role permissions. (A per-user override is resolved first, so an explicit override on an administrator's account still takes effect.)

3. Role Permissions

If no per-user override is set, your tier is derived from the permissions assigned to your role:

• If your role has the vault.tier.director permission, you get Director tier.

• If your role has the vault.tier.management permission, you get Management tier.

• If your role has neither, you get the default Staff tier.

The highest granted permission wins. If a role has both vault.tier.management and vault.tier.director, the user gets Director tier.

4. Default

If none of the above apply, your tier defaults to Staff.

Configuring Folder Access Levels

When creating or editing a folder, you choose its access tier:

Setting the Tier on a New Folder

1. Click New Folder in the Vault sidebar.

2. Enter the folder name.

3. In the Access Tier dropdown, select Staff, Management, or Director.

4. Click Create.

Changing a Folder's Tier

1. Select the folder in the sidebar.

2. Click the edit action.

3. Change the Access Tier dropdown to the desired level.

4. Click Save.

When you raise a folder's tier (e.g., from Staff to Management), team members below the new tier immediately lose visibility of that folder and all its secrets. When you lower a folder's tier, more team members gain access.

What Each Tier Can See

Here is a summary of what is visible at each tier level:

Staff Tier Users

• All folders with access tier set to Staff.

• Their own personal vault folders.

• Company vault folders set to Staff tier.

Management Tier Users

• All folders with access tier set to Staff or Management.

• Their own personal vault folders.

• Company vault folders set to Staff or Management tier.

Director Tier Users (and Administrators)

• All folders at every tier: Staff, Management, and Director.

• Their own personal vault folders.

• All company vault folders at every tier.

Role-Gated Access Configuration

To set up tier-based access for your team:

Step 1: Plan Your Folder Structure

Decide which folders need restricted access. Common patterns:

• Staff tier: General team passwords, shared tool logins, internal service accounts.

• Management tier: Client billing credentials, payment gateway keys, HR-sensitive logins.

• Director tier: Bank accounts, master admin credentials, legal/compliance secrets, encryption keys.

Step 2: Configure Roles

1. Navigate to Settings > Roles & Permissions.

2. For each role that needs elevated vault access, enable the appropriate permission:

   • vault.tier.management. Grants management-level vault access.

   • vault.tier.director. Grants director-level vault access.

3. Save the role.

Team members assigned to that role will immediately gain the corresponding tier access.

Step 3: Set Per-User Overrides (Optional)

For individual exceptions (e.g., a staff member who needs temporary access to management-tier folders):

1. Navigate to the user's account settings.

2. Set the Vault Tier Override to the desired tier.

3. Save.

This override takes priority over role-based tier resolution.

Audit Trail

Every significant action in the Vault is recorded in the audit log. This provides a complete record of who accessed what and when.

Tracked Actions

The following actions are logged:

What the Log Records

Each audit log entry includes:

• Action: The type of action performed.

• Secret name: The name of the affected secret (if applicable).

• Folder name: The name of the affected folder (if applicable).

• User: The name of the team member or "System" for automated actions.

• IP address: The IP address from which the action was performed.

• Timestamp: When the action occurred.

• Metadata: Additional context, such as the contact ID for shared secrets or the actor type for portal reveals.

Portal Access Logging

When a portal contact reveals a secret (either via a shared link or through company vault access), the audit log records the contact's ID and marks the actor type as "Contact" to distinguish portal reveals from team member reveals.

Viewing the Audit Log

1. Open the Vault from the main navigation.

2. Click the Audit Log button in the toolbar.

3. The log displays the 50 most recent entries in reverse chronological order.

Each entry shows the action, the affected secret or folder, the user who performed it, the IP address, and the timestamp.

Using the Audit Log for Security

The audit log is valuable for:

• Investigating breaches: If a credential is compromised, check who revealed it and when.

• Compliance reporting: Demonstrate that access to sensitive credentials is tracked and auditable.

• Monitoring patterns: Identify unusual access patterns, such as a user revealing many secrets in a short time frame.

• Verifying rotation: Confirm that secrets are being updated on schedule by checking for recent update actions.

Impersonation and Partner Switches

For security, the Vault is restricted during impersonation and partner tenant switch sessions:

• Impersonation: When an administrator impersonates another user, the Vault is read-only and secret reveals are blocked. The impersonating user cannot see or decrypt any secret values.

• Partner switch: When viewing a sub-tenant via a partner switch session, the Vault is completely blocked. Parent administrators cannot access sub-tenant vault data.

These restrictions ensure that elevated-access sessions (which may be logged separately or used for support) cannot be used to extract vault secrets.