Spinoza
Control who can see.
Control who can act.
A lawyer, administrator, billing colleague and digital assistant need different access. Spinoza is designed to check permission before the action happens.
Save time without handing over every permission.
Control access at the task and action, not only at the application login.
A login tells you who is using the application. The more important question is what that person or assistant may do with this client's information now. Spinoza is designed to make permission part of the action, including the boundary between a draft and a delivered message.
- Limit the case information a task can use.
- Choose which actions need a person.
- Apply access rules to summaries as well as source files.
Permission belongs
with the action.
Reading a document does not grant permission to send it. Preparing a message does not grant permission to deliver it.
Make the boundary specific.
An assigned task should have the access it needs.
| Action | Required access |
|---|---|
| Open a confidential document | Permission for that document and case |
| Prepare a client message | Access to the relevant information |
| Send the message | Permission for the recipient and action |
| Prepare billing | Access to the approved billing details |
A summary can contain
private information too.
Access rules should cover the original document and information derived from it. The design does not establish a security certification or a legal compliance guarantee.
Three different questions.
Three different permissions.
Illustrative example: an assistant prepares a reminder about a missing document. Each step needs its own permission.
May it read the case?
Access is limited to the information required for the task. Being able to open one case does not mean access to every client.
May it prepare a reminder?
The message uses the permitted case information. A draft can wait for review without being delivered.
May it send the reminder?
Check the recipient, the action and the required approval. If the rule does not allow it, the message must not be sent.
Define the action before granting access.
Review the information, recipients and approvals your first process would need.
Review the evaluation checklist