Data access model
How customer data will be isolated between organisations and users when the portal goes live.
This model requires a shared-database impact report and Row Level Security policies before any customer sees real data through the portal. Nothing is enforced today.
A parent organisation can contain child organisations and sites. Parents see all descendants. Children never see siblings or parents.
Every portal user belongs to exactly one organisation. Access is scoped to that organisation and its descendants — never above.
Owner/admin, Service manager, Reporting only, Finance/invoices. Roles gate both UI and any backend RPC the portal calls.
The oper8 operations team keeps a scoped override for support and exception handling. Overrides are logged and time-bounded.
- Shared DB impact report for organisation hierarchy columns and portal-account resolution.
- RLS policies on every customer-facing table (sites, services, collections, contracts, invoices).
- Customer user, role, and invitation tables (backend only, admin managed until portal auth is wired).
- Portal-safe RPCs for reads and write requests (goes to operator review queue).