Work through the decision
Identify current verified membership and the explicit record/action grant. Check whether access permits reading, editing, approving, exporting or downloading particular fields. Invitations, support access and external viewers need limited scope and expiry. Common ownership of the related brands does not permit one organisation to inspect another organisation’s work.
A fictional worked example
A fictional invited provider can read selected RFQ fields and its own response. It cannot inspect another supplier’s private quote or the buyer’s entire campaign budget. Switching to the related domain preserves the same limits.
Evidence and authority limit
A worksheet or browser-local draft does not enforce server tenant isolation; actual engine checks are required.
Put it into practice
Create an allowed/denied action table for an invited provider and a project reviewer.
Keep this record: A grant-scope matrix including field restrictions, expiry and revocation checks.
- Authority uses membership plus record grants.
- Read, edit, approval and export rights are separate.
- Brand context does not broaden access.
