Only our team, only our project, and the server decides.
Growth-OS holds our pipeline, our meeting transcripts, our decisions and our finance ledger. You sign in once, and from there the server works out which teammate you are and which project you are in. What the browser claims counts for nothing. Your role decides whether you can edit a decision or open the budget.
1
path that decides who you are
4
access levels behind every role name
0
project IDs trusted from the browser
Without a shared foundation, every team rebuilds these edge cases, differently.
A pipeline spreadsheet cannot tell salary lines apart from a prospect list. Everyone who can open it can read all of it, and nobody can tell you who did. Growth-OS resolves membership per project on every read and every write.
When each screen writes its own check, they slowly disagree. Finance opens to someone who was only meant to read, and nobody notices until an awkward conversation. One ranking function keeps every screen consistent.
Access checked once, when a page loaded, never expires. Here membership is resolved on the request itself, so removing someone from the project actually removes them.
The mechanism end to end, as implemented in the repository.
Clerk confirms the session
Sign-in runs through Clerk once per request. Without a session, nothing after this step runs at all.
The session maps to a teammate
The server looks that login up in our own users table. A login with no teammate record gets a clear error rather than a free pass.
Membership is checked next to the data
The same database call that reads or writes your record confirms you belong to that organization and project. There is no gap between the check and the work.
One function ranks the roles
roleAtLeast ranks viewer, editor, admin and owner, and every WISEPIM role name maps onto one of them. Organization owners keep access to every project; otherwise a project membership wins, falling back to the organization one.
Interactive example
This walkthrough demonstrates the implemented backend contract without using an account, credentials, or provider calls.
Interactive example
Deterministic sample data only. No account, provider, or network connection is used by the interaction.
Highlights
Every request is matched to a real teammate row in our own database. A session that maps to nobody stops at the door.
Owner, Founder, Admin, Editor, First hire, Advisory, Viewer. They rank into four access levels, compared by one function that every screen uses.
No session, no teammate record, or no membership in the project, and the request stops with a plain error instead of falling through to a default.
Engineering guarantees
Clerk runs the sign-in itself, so its availability is not ours to promise. What this proves is the server-side boundary: which teammate you are, and what that lets you touch.
The boundary above is code, not a claim. These files carry the contract:
src/server/auth.tssrc/server/permissions.tssrc/policies/roles.tsThese capabilities share contracts and boundaries with this one.
The docs describe the same contracts this page demonstrates.