Access Control
Every piece of time data in TimeCampus is access-controlled, workspace-isolated, and auditable — from day one, on every plan. TimeCampus inherits its governance from the Burdenoff platform's shared identity and access services, so access control isn't a bolted-on feature: it applies uniformly to every operation in the product.
Enforced at the edge
TimeCampus uses actor-based access control enforced at the platform edge. Every request — from the web app, mobile, desktop, CLI, or any other client — passes through the platform's gateway, where the caller's identity is validated and their permissions are checked before the request ever reaches TimeCampus itself.
What that means for you:
- No unguarded operations. Every read and write in TimeCampus is permission-checked — there is no side door that skips the check
- Consistent decisions. The same access rules apply no matter which client you use
- Unauthenticated requests never get in. A caller without a valid identity is rejected at the edge; a caller without the right permission gets a clear "forbidden," not partial data
Workspaces and isolation
The workspace is the container that owns membership, roles, data, and governance in TimeCampus.
- Everything is workspace-scoped. Every time entry, channel, project, and report belongs to a workspace, and every operation runs in the context of one
- Multi-tenant isolation is strict. Data from one workspace is never visible from another — cross-workspace access isn't a permission you can misconfigure; the per-workspace boundary makes it impossible
- Personal vs. shared workspaces. Individuals work in a personal context — a calm, private view of their own time. Teams and organizations work in shared workspaces, where visibility is governed by roles and team-level views are aggregate by design (see the Privacy model)
Creating your first workspace is covered in First workspace.
Roles and permissions
Access within a workspace is role-based: your role determines what you can see and do, per resource and per action. Permissions are scoped — being able to read something doesn't imply being able to change it, and being able to manage your own resources doesn't imply managing everyone's.
| Capability | Member | Admin |
|---|---|---|
| Track time, manage your own entries, use your timeline and insights | Yes | Yes |
| See shared workspace resources (projects, team views) per role | Yes | Yes |
| Manage workspace-level configuration (e.g. channels, shared setups) | Per role | Yes |
| Manage members and roles | No | Yes |
| Workspace-wide governance and settings | No | Yes |
Roles are assigned through the platform's workspace membership management. The exact permission set attached to each role is governed centrally, so it stays consistent across TimeCampus and every other product in your workspace.
Signing in
TimeCampus uses the platform's single sign-on:
- OIDC SSO — one identity across the web app and every client surface
- Terminal and automation clients authenticate through the same identity layer with flows suited to them (device-based sign-in for CLIs, API keys for automation)
- Enterprise identity options (such as SAML) are part of the Organization plan direction — see the FAQ and roadmap
One sign-in, one identity, uniformly enforced everywhere.
The audit trail
Every action in TimeCampus is attributable:
- Writes record who did them. Records carry the actor who created and last changed them
- Actions are logged to the platform's activity and audit services — searchable, and available to workspace admins
- Delegated actions are attributed — when something is done on someone's behalf, both identities are part of the record
The audit trail is what makes governance honest: not just rules about who can do what, but a record of who actually did what. For retention and export of audit data, see Data controls.
What this adds up to
A privacy-conscious organization can adopt TimeCampus knowing:
- Access is enforced at the edge — every operation, every client, no exceptions
- Workspaces never leak — strict per-workspace, per-tenant isolation
- Roles govern capability — scoped permissions, centrally managed
- Everything is auditable — every action attributable to an actor
- Team visibility is aggregate — governance and privacy point the same direction
Next steps
- Privacy model — what is and isn't captured
- Data controls — retention, export, and audit access
- First workspace — setting up your workspace