Status. Proposed design only. Nothing in this vault is GGA client approval. The GGA client documents are supplied drafts: see GGA-Source-Digest. No application, service or test has been executed; every scenario is Not executed. Delivery fees and dates are open.
Permissions and confidentiality
Sources: Blueprint pp. 3, 5, 6, 17 and the Concept and Architecture access levels (GGA-Requirement-Register). Treat organisation membership, profile eligibility, listing visibility and specific sharing consent as four separate checks.
| Role or state | Permitted | Limits |
|---|---|---|
| Public visitor | Approved summaries; public session and event descriptions | No member details, contacts or private files |
| Registered company, incomplete data | Own profile, missing-field guidance, public views | No detailed discovery, new interests or new event registrations |
| Eligible company owner or invited colleague | Member details, sessions, event registration, own interests and outcomes | Edits only own records; private material needs a scoped grant |
| Company with overdue data | Own profile, introduction history, outcomes, contribution records | Detailed discovery and new introductions pause; released contacts cannot be recalled |
| Approved country partner | Own listings and the consented pitches responding to them | No company directory, unrelated data or unrestricted exports |
| GGA operations owner | Review queues, listing decisions, profile exceptions, introductions, events | Reason required for sensitive overrides and exports; audited |
| Finance role | Opt-ins, billing details, invoices, payments, reconciliation | No capability documents or revenue unrelated to billing |
| Technical administrator | Accounts, configuration, support, recovery | No routine browsing of business data; exceptional access logged |
| Anand as convener | Programme dashboard, selected relationships, strategic exceptions | Routine queues belong to operations |
Eligible = verified contact + active company membership + all required profile fields + current company attestation + no administrative hold. The grace period counts as eligible. Contribution status is deliberately absent from the expression, and payment never overrides the freshness rule (GA07 in Acceptance-Gates-A01-A11).
Information layers
Public summary, member details, restricted material and internal metadata are stored and served separately. The approved public projection is the only source for unauthenticated pages, search previews and public APIs. Apply private-response caching rules and invalidate the approved projection when publication is withdrawn. Never expose gated data through analytics, logs, search indexes, exports or social previews. Copies already shared publicly cannot be guaranteed to disappear after withdrawal (Blueprint p. 17). Restricted material is released only through a scoped grant or an introduction consent package. Revenue, personal contacts and evidence are private by default.
Rules
- Check access on the server for every request, export, file download and background action; hiding a button is not a permission check.
- Scope every company-owned record to its company and every partner action to an owned or explicitly delegated opportunity.
- Re-check authorisation when a notification is queued, before delivery and when a link is opened; an email link is not an access grant.
- Denials must not reveal whether an inaccessible record exists: return 404 where existence must stay private, 403 for prohibited actions (T27).
- Previously released contacts cannot be recalled; withdrawal revokes future grants only.
- Acceptance of an introduction is not a confidentiality agreement and not a contract. Sensitive documents are shared only by scoped grant.
- Operations reach restricted business data only for review, exceptions and exports, with a recorded reason. Finance and capability files stay separate.
- Review checks completeness, authority to publish and obvious inconsistencies; it is not independent verification of every claim.
Retained from revision 1.3
Deny by default; participant-scoped access (an applicant’s pitch is isolated from other applicants, as B and C were isolated in A-B and A-C); revocation blocks future access but not copies already legitimately seen (T25); the canary-based isolation harness; DG metadata-only oversight becomes the technical administrator’s “exceptional access logged” rule.
Superseded
Invitation-only membership and DG membership approval (Q01, Q19) are replaced by verified registration and the eligibility expression. The platform roles above are new. Inside a company, the Blueprint names only the owner and invited colleagues; the finer 1.3 company roles (owner or admin, approver, contributor, viewer; Q02) received no GGA feedback and stay a Proposed carry-forward, as does the rule that company-admin access to company records is disclosed to the participants of an engagement. Open question N9 covers them.