Skip to main content

​
Overview

Sorcia implements multi-layer access control to ensure users only see documents they’re authorized to access.

​
Access Control Layers

​
Layer 1: Organization Membership

Database-level isolation Users must be members of an organization to access any data. 
-- Row-Level Security ensures org isolation
WHERE organization_id = current_user_org_id()

​
Layer 2: User Roles

Role-based permissions
RoleQueryManage TeamIntegrationsBilling
Owner✓✓✓✓
Admin✓✓✓✗
Member✓✗✗✗

​
Layer 3: Permission Groups

Custom group-based access Fine-grained control via permission groups:
  • Integration-level access
  • Source-level filtering
  • Document-type restrictions

​
Layer 4: Source Permissions

Mirrors original system Respects permissions from:
  • Slack (channel membership)
  • Google Drive (file sharing)
  • Notion (page access)
  • GitHub (repository access)

​
Query-Time Filtering

Every search automatically filters: 
function filterByPermissions(results, user) {
  return results.filter(doc => {
    // Check organization membership
    if (doc.org_id !== user.org_id) return false;
    
    // Check role permissions
    if (!hasRoleAccess(user.role, doc)) return false;
    
    // Check permission groups
    if (!hasGroupAccess(user.groups, doc)) return false;
    
    // Check source permissions
    if (!hasSourceAccess(user, doc)) return false;
    
    return true;
  });
}

​
Managing Access

​
Grant Access

1

Add to Group

Add user to appropriate permission group
2

Configure Group

Ensure group has access to required sources
3

Verify

Test with user account

​
Revoke Access

1

Remove from Group

Remove user from permission group
2

Update Source

Remove access in original system (Slack, Drive, etc.)
3

Verify

User should no longer see documents

​
Audit Trail

All access logged: 
{
  user_id: "user_123",
  document_id: "doc_abc",
  action: "query",
  timestamp: "2024-01-15T10:00:00Z",
  granted: true
}
View logs: Settings → Audit Logs

​
Security Scenarios

​
Confidential Documents

For sensitive information:
  1. Restrict in Source - Limit access in Google Drive/Notion
  2. Create Private Group - Permission group with specific users
  3. Monitor Access - Review audit logs regularly

​
Department Isolation

Separate department data: 
Sales Group:
  access:
    - google-drive: /Sales/*
    - slack: #sales*
  exclude:
    - google-drive: /Engineering/*
    - slack: #engineering*

Engineering Group:
  access:
    - github: all repos
    - slack: #engineering*
  exclude:
    - google-drive: /Sales/*
    - slack: #sales*

​
Temporary Access

Grant time-limited access:
  1. Add user to group
  2. Set calendar reminder to revoke
  3. Remove after period expires
Automated time-limited access coming soon (Enterprise)

​
Best Practices

Start with no access, grant as needed
Review access quarterly
Manage access via groups for scalability
Check audit logs for unusual access patterns

​
Troubleshooting

  1. Verify org membership
  2. Check role permissions
  3. Confirm permission group membership
  4. Verify source system access
  5. Check audit logs
User may have broad access. Create more restrictive group.

​
Next Steps

Security Overview

Learn about security

Audit Logs

View access logs