Access Requirements
Purpose: The principles that decide who gets access to what at Summit, and the process for granting, reviewing, and removing it. This document deliberately contains no credentials, no keys, and no account identifiers; it defines the rules, not the secrets. Rosa administers day-to-day access; Dave approves exceptions.
Principles
- Least privilege. Everyone gets the minimum access their role needs to do the job, and nothing more. Convenience is not a justification for admin rights.
- Access follows role, not person. When someone's role changes, their access changes the same week. New responsibilities earn new access; old access gets removed, not left "just in case."
- One owner per system. Every tool in the Tool Stack Map has a named owner who is the only person who grants access to it.
- Individual accounts only. No shared logins. If two people share an account, nobody is accountable for what happens in it, and removing one person's access means resetting everyone.
- Read before write. Default any new grant to read/view. Write, send, publish, and admin rights each require a stated reason.
- External parties get the narrowest possible slice. Vendors and the agency get per-file share links or scoped guest access with an expiry, never membership in Summit's core systems.
- The agent is a role like any other. The Hermes agent's access is defined the same way a human's is: broad read across approved knowledge and systems, draft-only write, and zero ability to send externally, change CRM stages, publish, or touch financials. See Prohibited Agent Actions.
Access by role (pattern, not inventory)
| Role | Typical access shape |
|---|---|
| Owner (Dave) | Broad read everywhere; admin only where he's the system owner; financial systems |
| Office Manager (Rosa) | Admin on CRM, calendars, and Drive structure; financial data entry; user provisioning |
| Sales (Marcus + reps) | Write on their own pipeline records and sales folders; read on shared sales assets |
| Estimator (Tara) | Write on estimates and her visit outcomes; read on sales and pricing docs |
| Production (Pete + crew leads) | Admin on photo system and production calendar; read on won-job records |
| Marketing (Jenna) | Write on marketing folders and business profile; no CRM admin, no financials |
| Field crews | Photo upload and day-of schedule visibility; nothing else |
| Hermes agent | Read on approved knowledge and CRM; draft-only write; no external send, no stage changes, no publishing |
The authoritative who-can-do-what for each individual system lives with that system's rules (for example GoHighLevel CRM Rules and File Storage); this table is the pattern those rules follow.
Granting access
- Requester states what they need to do (the task, not the tool).
- The system owner decides the minimum access level that accomplishes it.
- Rosa provisions it and notes the grant (who, what level, why, date) in the access log in Drive.
- Anything above read-level on a customer-facing or financial system also needs Dave's OK.
Removing access
- Departures: all access removed the same day, before the exit conversation ends. Rosa keeps an offboarding checklist per system so nothing is missed.
- Role changes: within the week, per principle 2.
- Vendors and the agency: expiring links wherever the platform supports them; standing external access reviewed monthly.
Quarterly access review
Rosa runs it; Dave signs it. For each system: pull the current user list, check it against the role table above, remove anything that no longer matches, and confirm external shares are still needed. The review is boring on purpose; if it ever turns up surprises, the granting process failed upstream.
Secrets hygiene
- Passwords live in each person's password manager, never in documents, chats, or this vault.
- No credentials, API keys, or account numbers are ever written into the Company Brain. The brain holds rules and knowledge; secrets stay in systems built to hold secrets.
- Anyone who suspects a credential leaked tells Rosa immediately; she rotates it first and investigates second.
Related
Want documentation like this for your business?
Every Company Brain engagement produces documents at this level of detail — captured from your team, organized, and wired into an agent.