Workspace compliance features
Access control that ships with every SpreadSpace workspace. These features govern the people working in the app; machine access is governed by scoped API keys.
Role-based access control
Six roles, scoped to what each person actually does. Auditor is read-only and sees audit logs alone. Underwriter is the operational role: it moves work without touching members or billing. Developer is the integration role: it manages API keys and webhooks and nothing else.
| Capability | Owner | Admin | Supervisor | Underwriter | Developer | Auditor |
|---|---|---|---|---|---|---|
| Manage billing & spend caps | ||||||
| Enforce MFA org-wide | ||||||
| Manage roles (RBAC) | ||||||
| Invite / remove membersSupervisor may invite Underwriters only. | ||||||
| Assign users to borrowers | ||||||
| Create / edit borrowers & loans | ||||||
| Delete borrowers & loans | ||||||
| Upload documents | ||||||
| View documents & extractions | ||||||
| View audit logs | ||||||
| Manage API keys | ||||||
| Tag counterparties | ||||||
| Delete org / transfer ownership |
Machine access is separate. An API service identity authorizes through scoped API-key grants, not a role, so automated callers only reach what their key allows. See API Security in the compliance bundle.
Workspace users also enjoy all of the same compliance features from the compliance bundle.