Workspace compliance features
Access control that ships with every SpreadSpace workspace. These features govern the people working in the app; machine access is governed by scoped API keys.
Role-based access control
Six roles, scoped to what each person actually does. Auditor is read-only and sees audit logs alone. Underwriter is the operational role: it moves work without touching members or billing. Developer is the integration role: it manages API keys and webhooks and nothing else.
| Capability | Owner | Admin | Supervisor | Underwriter | Developer | Auditor |
|---|---|---|---|---|---|---|
| Manage billing & spend caps | ||||||
| Enforce MFA org-wide | ||||||
| Manage roles (RBAC) | ||||||
| Invite / remove membersSupervisor may invite Underwriters only. | ||||||
| Assign users to borrowers | ||||||
| Create / edit borrowers & loans | ||||||
| Delete borrowers & loans | ||||||
| Upload documents | ||||||
| View documents & extractions | ||||||
| View audit logs | ||||||
| Manage API keys | ||||||
| Tag counterparties | ||||||
| Delete org / transfer ownership |
Machine access is separate. An API service identity authorizes through scoped API-key grants, not a role, so automated callers only reach what their key allows. See API Security in the compliance bundle.
See how source tracing and report activity support review in our guide to auditable financial analysis.
Workspace users also enjoy all of the same compliance features from the compliance bundle.