Security & governance
Fine-grained control, standard equipment
klerc's authorization engine resolves org, role, team, and per-record grants on every request — with field-level enforcement, org-wide defaults, an append-only audit stream, and admin kill-switches per feature.
Access model
Roles, hierarchy, teams — resolved per request
System roles (owner, admin, member) plus custom roles with permission sets — reusable grant bundles across objects, records and features. A drag-and-drop role hierarchy gives managers visibility over their subordinates' records; teams group people for assignment and sharing.
- Custom roles with parent hierarchy
- Permission sets: reusable grant bundles
- Org chart editor with drag-reorder
- Invites with accept / revoke lifecycle
Record & field security
Who sees what, down to the field
Org-wide defaults set the baseline per object — private, read, or read-write. Explicit shares grant access to a user, team or role per record. Field-level permissions hide or lock individual fields, enforced identically in the UI, the query engines, and the API.
- Org-Wide Defaults per object type
- Per-record sharing to user / team / role
- Field read / write / hidden enforcement
- Effective-permissions endpoint drives UI gating
Audit
An append-only record of everything
Logins, record access, field-level diffs, exports, admin and membership changes, denied attempts — streamed to an append-only columnar log with device fingerprints and 45-day retention, exportable to CSV.
- Security, auth, data and admin categories
- Field diffs on record changes
- Denied-access events captured too
- CSV export for compliance workflows
Account security
Sign-in hardened by default
Email OTP as a second factor with trusted-device management — devices expire after 30 days and can be revoked. API access uses scoped tokens that intersect with the caller's live permissions, so a leaked token never exceeds the human behind it.
- OTP 2FA with trusted devices
- Scoped API tokens (feature × action)
- Tokens respect live role permissions
- Rate limits on auth and API surfaces
Governance toolkit
Feature toggles
Turn modules off org-wide — enforced with 403s at the API, hidden in the UI.
Search access policy
Choose who can query what: whole org, restricted, or admins only.
Materialized ACLs
Access tokens denormalized onto records for fast, scoped search and analytics.
Session control
401-only session termination; device fingerprints on sensitive actions.
Encrypted secrets
Third-party OAuth tokens stored AES-encrypted with signed state.
Soft delete
Records survive accidents; deletion is a state, not an event.
Works better together
Related modules
Run your whole business from one tab.
Join the early access — bring your team, connect your channels, and keep every workflow in one place.