Governance · Access & Audit
Access Model & Audit Trail
A simulated four-tier access model over fictional sample data. It shows who sees what, which commercial fields are masked, and every account view recorded against a role.
Simulated access control. There is no login here — switching roles in the sidebar changes what the app shows. In production this becomes Supabase Auth plus row-level security keyed to the user's role and assigned accounts, with the audit trail written server-side.
The four tiers
| Role | Also known as | Scope | Sees |
|---|---|---|---|
| CSM | Enterprise Account Manager | Own assigned accounts | exact ARR · ticket detail · stakeholder notes |
| CS Lead | Key Accounts Manager | Team portfolio · can reassign | exact ARR · ticket detail · stakeholder notes · cross-team trends · reassign accounts |
| VP Customer Success | Director – Account Management | Whole org view | exact ARR · ticket detail · stakeholder notes · benchmarks · cross-team trends · reassign accounts |
| CXO | Exec Sponsor | Rolled-up dashboards only | ARR band only · benchmarks · cross-team trends |
Field masking
- Contract value and ARR render through a single masking helper, never raw.
- CXO / Exec sees a size band (Strategic, Large, Mid, Small) instead of the figure — enough to prioritise, not enough to leak commercials into exec decks.
- Ticket-level detail and stakeholder notes are hidden from exec views to keep them signal, not noise.
- CSMs see exact commercials only for accounts assigned to them.
View audit trail (0)
Nothing recorded yet. Open an account in Customer 360, Health Scores or the Customer Org Map and it will appear here against your current role.
How this is built for real
- Supabase Auth for sign-in; a separate
user_rolestable (never a column on profiles). - RLS on every customer-scoped table: CSMs match
assigned_csm = auth.uid(), Leads match their team, VP and CXO read all — enforced in the database, not the UI. - Field-level masking via role-aware views so masked columns never leave the server.
- Append-only
access_audittable written server-side on every account read, with a retention window appropriate for BFSI review cycles.