In traditional security software, Role-Based Access Control is often implemented as a flat, single-tier hierarchy. You are either an Admin, Member, or Viewer across the entire application.
In the real world of cybersecurity consulting, this flat model breaks down immediately.
🛑 The Conflict Scenario
Consider an external security firm auditing three different banking clients:
- Tester A is the lead auditor on Bank Alpha.
- Tester B is the lead auditor on Bank Beta.
- Client Spectator C needs to observe findings in real-time on Bank Alpha, but must have zero visibility into Bank Beta.
If access is flat, either Tester A has access to all client databases, or you have to spin up entirely separate server instances for every single client.
⚡ The Two-Tier Solution
blackLen decouples Organization Governance (Tier 1) from Project Engagements (Tier 2):
- Tester A is a standard
Memberin the consultancy organization, but holdsProject Adminauthority over Bank Alpha. - Client Spectator C is an Organization
Viewer, bound by the Ceiling Rule so they can never be promoted to an Editor or Auditor on any project. - The Tick-Mark Only Auditor role allows junior QA testers to execute checklists without risking scope tampering.
This provides military-grade access control boundaries without operational bottlenecks.