Control who sees what. By company, department and role.
Build roles from individual permissions, grant them for a company or department with start and end dates, enforce MFA, and keep a change history on every record.
Eleanor Vance-SterlingPlatform Engineering & OperationsFull AccessThe whole company, every departmentLiveLinked
Lucy HargroveFinance & AccountingFinanceThe whole company, every departmentLiveDepartment ManagerFinance & Accounting onlyEnds on Dec 31Linked
Patrick CallahanPlatform Engineering & OperationsDepartment ManagerPlatform Engineering & Operations onlyLiveReaderMesabrook Nearshore, the whole companyLiveLinked
Madeline ChoPlatform Engineering & OperationsNo access role, self-service onlyLinked
Julian Mercer-HayesTransformation & Change ManagementReaderTransformation & Change Management onlyStarts on Nov 16Not linked
Valerie HolbrookShe gets the role’s permissions on that department only, from the start date. Until then the grant shows Starts on Dec 1.
Access control at Mesabrook
How Mesabrook controls who sees its financial data.
Build roles around what people do
Access roles carry permissions: Executive can read everything, Department Manager runs a department, and Finance and HR manage their own areas. Job titles never grant access.
- Duplicate a role to start a new one
- Retire a role and keep its history
- See how many people hold each role
Can see and change everything in the workspace.
Read and export everything across the organization. No write or admin.
Full operational control of a department: activities, timesheets, invoices, purchases, team.
Financial resources including writes: invoices, purchases, payments, statements, exchange rates.
People resources including writes: employees, contracts, leave, evaluations. Cannot delete employees.
Describes what someone is. It cannot carry permissions.
Set permissions by action
Choose read, write, approve, delete and export for each module. Deal permissions can be limited to your own deals, your team’s or all deals. KPilot shows who gains or loses access before you save.
- Financial approvals marked as sensitive
- Admin permissions kept separate
- Unused permissions clearly labeled
Secure every sign-in
See who uses a passkey or an authenticator app, require MFA for an account, or end all of its sessions. Each person manages their own sign-in settings.
- Passkeys and authenticator apps
- Sign in with Microsoft Entra ID
- End all sessions in one click
See who changed what
Every record keeps a history of who created it, what changed and when. Roles, access grants, exchange rates and workflows keep their own history.
- History on invoices, payments and projects
- Visible only with the right permission
- Separate history for roles and workflows
Lucy HargroveNov 4, 16:20RemindersLucy HargroveOct 5, 09:14StatusPatrick CallahanOct 4, 17:02Due datePatrick CallahanOct 4, 16:55InvoiceCreated, $79,500Choose where KPilot can send email
Pick the domains KPilot is allowed to email. Messages to other addresses are held back and listed with the reason. Each customer has its own environment and database.
- Allowed domains and addresses
- Held and failed messages, with reasons
- Orkestra limited to each person’s access
Everyone can see their own access
Each person can see what they can do, where, who granted it, and which approvals come to them.
Patrick CallahanEngagement Director · Chicago, ILYou have access to Platform Engineering & Operations and to Mesabrook Nearshore, read only.
Group settings and other companies are managed by Eleanor Vance-Sterling and Lucy Hargrove.Questions
Can a manager see only their department?
Yes. Grant the role on the department: every screen, report, brief and Orkestra answer is limited to it by the server.
Can access start or end on a date?
Yes. Every grant has a start and an optional end, and shows Starts on or Ends on until then.
Do you support MFA and passkeys?
Yes: passkeys, authenticator apps and Microsoft sign-in through Entra ID. An administrator can require MFA account by account.
Can a person see what they have access to?
Yes. Your access says, in plain words, what each person may do, where, who granted it, and which decisions arrive for them.
Where is our data?
Each customer runs in its own environment, with its own database. Email leaves it only to the domains you allow.
Give each person the right access.
Start with Mesabrook’s roles, or set up your own.