Restrict-only, and why
A module access rule can remove a module from a person. It cannot give them one the organisation does not have. That asymmetry is deliberate: it means the table can never quietly expand what a workspace is entitled to, it means an absent row is safe rather than ambiguous, and it means adding the feature changed nobody's access on the day it shipped.
| Organisation has it | Person has a rule | Result |
|---|---|---|
| Yes | No row | Can open it |
| Yes | Removed | Cannot open it |
| No | No row | Cannot open it |
| No | Allowed | Still cannot open it |
The last row is the one worth internalising. A rule naming a module the organisation never bought grants nothing at all — it is not an error, it simply has no effect.
Where it is enforced
At the hand-off. Eleven of the twelve modules get their session by exchanging a shell token, and the token mint is where access is checked — which is why the control works across the whole suite without any module having to implement it.
It also removes the module from the rail, so a restricted module is not merely refused, it is not offered. A person who cannot open Accounting does not see Accounting.
Module access
Rules remove. They never grant.
| Person | Module | Rule | Note | Set by |
|---|---|---|---|---|
| Tom Baird | Accounting | Removed | Not in finance | Dana |
| [email protected] | Accounting | Removed | Contractor | Dana |
| [email protected] | CRM | Removed | Contractor | Dana |
| [email protected] | Chat | Removed | Contractor | Dana |
| Priya Raman | CRM | Removed | No sales duties | Sam |
How to use it well
- Set it as people arrive, not as a tidy-up later. Removing access somebody has been using is a conversation; never granting it is not.
- Write the note. Every rule takes a free-text note. "Contractor" or "not in finance" saves the quarterly review from being an archaeology exercise.
- Review it monthly alongside the members list. See Operate.
- Do not use it as a security boundary for data inside a module. It controls the door, not the room. A person with Accounting access sees the whole ledger.
Removing a module stops the next hand-off. A module that has already minted its own session may honour it until it expires. For a departure, remove the membership and revoke sessions — do not rely on module access alone.
What this does not do
It is open or closed. There is no view-only or one-project scope.
Rules attach to a person. There is no group to attach one to.
A seat is a member, not a module. Removing modules from somebody does not reduce the bill.
Accounting reads the shell cookie directly rather than exchanging a token, so it is entitlement-gated rather than rule-gated.
Questions
Does the person know they were restricted?
Not explicitly. The module is simply absent from their rail.
Can a member set their own rules?
No. Administrators only.
Is there an audit trail?
Yes. Rule changes are recorded with who made them.