Access Control Policy

Last updated 15 October 2026 · Owner: Koana Works administrator · Reviewed at least once a year

1. Principles

Access follows least privilege and need-to-know. Each person has their own account; shared logins are not used for administration.

Each organization's data is separated by row-level security in the database.
Roles (member, officer and specialist roles such as treasurer) decide what each person can see and do.
Officers manage their own organization's members and roles. When an officer term ends at handover, their elevated access ends too.
Private comments and personal notes are visible only to their author and the people they choose, and this is enforced by the database.
Sign-in uses Supabase Auth with email links or Google.

The administration console ("Deus", admin.koanaworks.com) requires a platform administrator account with two-step sign-in.
Console roles are owner, support and read-only.
Club data appears in the console as codes unless an administrator explicitly reveals names, and that action is logged.
Sensitive console actions can require approval from a second administrator.
All console actions are written to an audit log that cannot be edited.
Cloud consoles (Cloudflare, Supabase, GitHub, Google Cloud, Zoom, Meta) are limited to named administrators with multi-factor authentication.

Access is granted by an owner, recorded in the access register, and limited to what the role needs.
Access is reviewed every quarter: the console reminds administrators, and the review is recorded.
When someone leaves, all their access is removed the same day, and any secrets they could reach are rotated.