Teams and Security

Understand multi-tenant resource boundaries, role permissions, authentication, and audit

Clouisle isolates Agents, Workflows, Knowledge Bases, model authorization, tools, and Skills by team. The current team determines the boundary for querying and creating resources in the platform workspace.

Team roles

Team roles are owner, administrator, member, and viewer. The owner handles ownership transfer and cannot be removed or leave directly; administrators can manage team resources; finer-grained operations are decided jointly by global role permissions and scoped roles.

Permissions

Backend permission codes use resource:action or admin:resource:action. Super administrators bypass permission checks. Non-admin resources can also be authorized through team- or resource-scoped roles. The frontend hides menus based on permissions, but the backend still checks permissions on every request.

Session and data isolation

Regular users can only see their own conversations and data; users with admin:dashboard:access (or Super Admin) can view all team conversations, and team-scoped queries additionally require the team owner/administrator role. API Keys are managed per user: users can only view and manage their own keys; only Super Admin can view all keys across teams.

Authentication and account security

The site can combine password sign-in, email verification, administrator approval, click captcha, password policy, password expiration, single session, TOTP, and SSO. SSO supports multiple connections; administrators can disable password sign-in. Active sessions default to 30 days (controlled by the session_timeout_days site setting); the JWT fallback token lasts 8 days.

API Keys

API Keys start with clou_ and are sent via Authorization: Bearer. A key can be restricted to Agents, Workflows, expiration, and requests per minute; when resources are unrestricted, it can access all matching resources. The per-minute request limit is counted per user, not per team.

Audit and notifications

The admin panel records resource operations, actors, and change snapshots, and offers filtering by event, user, team, and time. Notifications can be shown in-app and sent out via email, DingTalk, WeCom, Feishu, Slack, or Webhook.