Nothing is allowed because they got in
Sign-in answers “who is this?”. Each click (read, write, share, delete, sign) is asked again, against this file, this version, this moment. If nobody granted that action, it is refused.
Authorisation
Signing in establishes identity. Each action still has to pass policy.
A person can be allowed to read a sensitive file and still be prevented from sharing it outside the organisation. Casewelt keeps that distinction explicit by evaluating policy against the action and the resource after authentication.
Example
A People director needs the compensation file, but must not send it externally.
The director can read the compensation file while the external-share action is denied by policy. Those two decisions stay distinct after sign-in.
When the session is later revoked, the previously permitted read stops. Identity, session state and resource authorisation stay distinct.
Policy decisionpeople.director
Readcompensation-2026.xlsxAllow
Create external sharesame fileDeny
Same identity. Different action. Different decision.
Decision model
Make each boundary visible.
01
Who is asking
Confirm the person, system or recipient making the request.
02
Is the session still good
Check it has not expired or been revoked since they signed in.
03
May they do this
Apply your rules to this exact action, on this exact file.
04
By the right route
Staff, outside recipients and administrators each stay on their own path.
Why it matters
Least privilege is easier to operate when “read” and “share” are not synonyms.
Many incidents with sensitive files begin with a legitimate user doing something the organisation did not mean to authorise. Fine-grained decisions make that boundary testable: the same person can succeed at ordinary work and fail safely at a more sensitive action.
This also produces better audit evidence. A policy denial is different from a broken login or an application error, and the product should preserve that difference.
See how decisions appear in auditWhat the product actually checks
Default deny. Then the exception you meant.
Roles, then the file
A role can open a class of work. A folder can still be tighter. Being “a lawyer” does not open every matter. Being on a matter does not let you send it outside if policy says no.
Groups instead of fifty ticks
Grant the room to a group. When someone changes team, you change the membership. You do not hunt down every file they ever touched.
Walls between engagements
Two teams can share an organisation and still not see each other’s matters. An ethical wall is a product rule, not an honour system in a shared drive.
Machines are not people
A scanner or a script enrols as a device. It does not borrow a password. If that device is revoked, the next call stops even if someone still knows last week’s secret.
The refusal has a name
Automation sees policy_denied or deny, not a generic 500. People see that they are still signed in. Audit stores the difference.
When you try it
- The same person: read allowed, external share refused, session still valid.
- Revoke the session and retry the read. It must stop.
- Show the refusal in audit as a policy decision, not as “login failed”.
- Put two people in the same organisation on opposite sides of a wall and confirm neither sees the other’s folder.
Test a rule
Test Casewelt against a real access rule.
Describe the resource, the people who need it and the actions that must remain restricted. We’ll use that as the basis of the walkthrough.