From a8ffa51e31731576d14b402562bc446431d87987 Mon Sep 17 00:00:00 2001 From: Vit Horacek Date: Thu, 17 Sep 2026 16:44:42 +0200 Subject: [PATCH 1/6] Document Auditor role membership rules in the security philosophy --- contributingGuides/philosophies/SECURITY.md | 55 ++++++++++++--------- 1 file changed, 31 insertions(+), 24 deletions(-) diff --git a/contributingGuides/philosophies/SECURITY.md b/contributingGuides/philosophies/SECURITY.md index b452f0106a0b..ab61e76899c5 100644 --- a/contributingGuides/philosophies/SECURITY.md +++ b/contributingGuides/philosophies/SECURITY.md @@ -33,12 +33,12 @@ Updated rules for managing members across all types of chats in New Expensify. ### Workspace Rooms #### Workspace -| | Creator | Member(Employee/User) | Admin | Auditor? | -| :----------------: | :-----: | :-------------------: | :---: | :------: | -| **Invite** | ✅ | ❌ | ✅ | ❌ | -| **Remove** | ✅ | ❌ | ✅ | ❌ | -| **Leave** | ❌ | ✅ | ❌ | ✅ | -| **Can be removed** | ❌ | ✅ | ✅ | ✅ | +| | Creator | Member(Employee/User) | Admin | Auditor | +| :----------------: | :-----: | :-------------------: | :---: | :-----: | +| **Invite** | ✅ | ❌ | ✅ | ❌ | +| **Remove** | ✅ | ❌ | ✅ | ❌ | +| **Leave** | ❌ | ✅ | ❌ | ✅ | +| **Can be removed** | ❌ | ✅ | ✅ | ✅ | - Creator can't leave or be removed from their own workspace - Admins can't leave from the workspace @@ -47,35 +47,40 @@ Updated rules for managing members across all types of chats in New Expensify. - Members and Auditors cannot invite or remove anyone from the workspace #### Workspace #announce room -| | Member(Employee/User) | Admin | Auditor? | -| :----------------: | :-------------------: | :---: | :------: | -| **Invite** | ❌ | ❌ | ❌ | -| **Remove** | ❌ | ❌ | ❌ | -| **Leave** | ❌ | ❌ | ❌ | -| **Can be removed** | ❌ | ❌ | ❌ | +| | Member(Employee/User) | Admin | Auditor | +| :----------------: | :-------------------: | :---: | :-----: | +| **Invite** | ❌ | ❌ | ❌ | +| **Remove** | ❌ | ❌ | ❌ | +| **Leave** | ❌ | ❌ | ❌ | +| **Can be removed** | ❌ | ❌ | ❌ | - No one can leave or be removed from the #announce room +- Auditors are added to #announce when they join the workspace, so they can't leave or be removed from it either +- Only workspace admins can post in #announce. Every other role, auditors included, sees the room as read-only #### Workspace #admin room -| | Admin | -| :----------------: | :---: | -| **Invite** | ❌ | -| **Remove** | ❌ | -| **Leave** | ❌ | -| **Can be removed** | ❌ | +| | Admin | Auditor | +| :----------------: | :---: | :-----: | +| **Invite** | ❌ | ❌ | +| **Remove** | ❌ | ❌ | +| **Leave** | ❌ | N/A | +| **Can be removed** | ❌ | N/A | - Admins can't leave or be removed from #admins +- Auditors are not members of #admins, so leaving and being removed don't apply to them. Changing a member's role to Auditor removes them from the room +- Only workspace admins can post in #admins #### Workspace rooms -| | Creator | Member | Guest(outside of the workspace) | -| :----------------: | :-----: | :----: | :-----------------------------: | -| **Invite** | ✅ | ✅ | ✅ | -| **Remove** | ✅ | ✅ | ❌ | -| **Leave** | ✅ | ✅ | ✅ | -| **Can be removed** | ✅ | ✅ | ✅ | +| | Creator | Member | Auditor | Guest(outside of the workspace) | +| :----------------: | :-----: | :----: | :-----: | :-----------------------------: | +| **Invite** | ✅ | ✅ | ✅ | ✅ | +| **Remove** | ✅ | ✅ | ✅ | ❌ | +| **Leave** | ✅ | ✅ | ✅ | ✅ | +| **Can be removed** | ✅ | ✅ | ✅ | ✅ | - Everyone can be removed/can leave from the room including creator - Guests are not able to remove anyone from the room +- Auditors are not added to user-created rooms automatically. They can discover and join non-private workspace rooms, and they can leave freely, like any other workspace member #### Expense chats | | Admin | Member(default) | Member(invited) | @@ -90,6 +95,8 @@ Updated rules for managing members across all types of chats in New Expensify. - Invited members(invited by members) are not able to invite or remove from the expense chat - Invited members(invited by members) are able to leave the expense chat - Default members and admins are able to remove invited members +- Auditors are default members of their own expense chat, so they can't leave or be removed from it +- Auditors added to another member's expense chat are able to leave it, because they are not workspace admins ### Domain chat | | Member | From 8e3d6b0d04698d0a7e2125a0a69b62fef650f972 Mon Sep 17 00:00:00 2001 From: Vit Horacek Date: Thu, 17 Sep 2026 16:59:22 +0200 Subject: [PATCH 2/6] Correct the Auditor rules for #admins and expense chats against the Auth behaviour --- contributingGuides/philosophies/SECURITY.md | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/contributingGuides/philosophies/SECURITY.md b/contributingGuides/philosophies/SECURITY.md index ab61e76899c5..356b2a5a278d 100644 --- a/contributingGuides/philosophies/SECURITY.md +++ b/contributingGuides/philosophies/SECURITY.md @@ -63,12 +63,14 @@ Updated rules for managing members across all types of chats in New Expensify. | :----------------: | :---: | :-----: | | **Invite** | ❌ | ❌ | | **Remove** | ❌ | ❌ | -| **Leave** | ❌ | N/A | -| **Can be removed** | ❌ | N/A | +| **Leave** | ❌ | ❌ | +| **Can be removed** | ❌ | ✅ | - Admins can't leave or be removed from #admins -- Auditors are not members of #admins, so leaving and being removed don't apply to them. Changing a member's role to Auditor removes them from the room -- Only workspace admins can post in #admins +- Auditors are added to #admins when they are given the Auditor role, and membership follows the role rather than manual invites +- Auditors can read and comment in #admins. Unlike #announce, the room has no admins-only write capability +- No one can leave #admins, auditors included +- Auditors can be removed from #admins, and they lose the room when their role changes to one without #admins access #### Workspace rooms | | Creator | Member | Auditor | Guest(outside of the workspace) | @@ -80,7 +82,8 @@ Updated rules for managing members across all types of chats in New Expensify. - Everyone can be removed/can leave from the room including creator - Guests are not able to remove anyone from the room -- Auditors are not added to user-created rooms automatically. They can discover and join non-private workspace rooms, and they can leave freely, like any other workspace member +- Auditors are not added to user-created rooms automatically. They can discover and join non-private workspace rooms, and they can leave freely +- Auditors can invite and remove other participants in any room they are a participant of #### Expense chats | | Admin | Member(default) | Member(invited) | @@ -95,8 +98,9 @@ Updated rules for managing members across all types of chats in New Expensify. - Invited members(invited by members) are not able to invite or remove from the expense chat - Invited members(invited by members) are able to leave the expense chat - Default members and admins are able to remove invited members -- Auditors are default members of their own expense chat, so they can't leave or be removed from it -- Auditors added to another member's expense chat are able to leave it, because they are not workspace admins +- Auditors are added to every workspace expense chat, so they can see the expenses on the workspace, and they are able to comment +- Auditors are not able to be removed from an expense chat +- Auditors are able to leave another member's expense chat, but not their own ### Domain chat | | Member | From c52a545b3ff8136b093062c6fa8339a86fa389f2 Mon Sep 17 00:00:00 2001 From: Vit Horacek Date: Thu, 17 Sep 2026 21:05:07 +0200 Subject: [PATCH 3/6] Fix the Auditor rule for user-created workspace rooms --- contributingGuides/philosophies/SECURITY.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/contributingGuides/philosophies/SECURITY.md b/contributingGuides/philosophies/SECURITY.md index 356b2a5a278d..8781489d857b 100644 --- a/contributingGuides/philosophies/SECURITY.md +++ b/contributingGuides/philosophies/SECURITY.md @@ -82,8 +82,8 @@ Updated rules for managing members across all types of chats in New Expensify. - Everyone can be removed/can leave from the room including creator - Guests are not able to remove anyone from the room -- Auditors are not added to user-created rooms automatically. They can discover and join non-private workspace rooms, and they can leave freely -- Auditors can invite and remove other participants in any room they are a participant of +- Auditors are added to the workspace rooms that are not private when they are given the Auditor role. Private rooms are skipped, so they join those by invitation only +- Auditors are able to invite and remove other participants in the rooms that their role shared with them #### Expense chats | | Admin | Member(default) | Member(invited) | From b9698ad54020b54a3211b52569411bac1382edeb Mon Sep 17 00:00:00 2001 From: Vit Horacek Date: Thu, 17 Sep 2026 22:21:44 +0200 Subject: [PATCH 4/6] Mark auditors as non-removable from #admins to match the automatic-membership rule --- contributingGuides/philosophies/SECURITY.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/contributingGuides/philosophies/SECURITY.md b/contributingGuides/philosophies/SECURITY.md index 8781489d857b..a19310ec44a5 100644 --- a/contributingGuides/philosophies/SECURITY.md +++ b/contributingGuides/philosophies/SECURITY.md @@ -10,6 +10,7 @@ Updated rules for managing members across all types of chats in New Expensify. - Admins MUST NOT be able to leave or be removed from expense chats - Members MUST NOT be able to leave or be removed from the #announce room - Admins MUST NOT be able to leave or be removed from #admins +- Auditors MUST NOT be able to leave or be removed from #admins - Domain members MUST NOT be able to leave or be removed from their domain chat - Report submitters MUST NOT be able to leave or be removed from their reports - Report managers MUST NOT be able to leave or be removed from their reports @@ -64,13 +65,13 @@ Updated rules for managing members across all types of chats in New Expensify. | **Invite** | ❌ | ❌ | | **Remove** | ❌ | ❌ | | **Leave** | ❌ | ❌ | -| **Can be removed** | ❌ | ✅ | +| **Can be removed** | ❌ | ❌ | - Admins can't leave or be removed from #admins - Auditors are added to #admins when they are given the Auditor role, and membership follows the role rather than manual invites - Auditors can read and comment in #admins. Unlike #announce, the room has no admins-only write capability - No one can leave #admins, auditors included -- Auditors can be removed from #admins, and they lose the room when their role changes to one without #admins access +- Auditors lose #admins when their role changes to one that has no #admins access. That is a role change, not a removal from the room #### Workspace rooms | | Creator | Member | Auditor | Guest(outside of the workspace) | From 054d0e58396074edbad9e643fb6b5509c0f83df2 Mon Sep 17 00:00:00 2001 From: Vit Horacek <36083550+mountiny@users.noreply.github.com> Date: Fri, 18 Sep 2026 12:46:43 +0200 Subject: [PATCH 5/6] Apply batched suggestions from code review Co-authored-by: Florent De'Neve --- contributingGuides/philosophies/SECURITY.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/contributingGuides/philosophies/SECURITY.md b/contributingGuides/philosophies/SECURITY.md index a19310ec44a5..4abfa28f7e8d 100644 --- a/contributingGuides/philosophies/SECURITY.md +++ b/contributingGuides/philosophies/SECURITY.md @@ -59,7 +59,7 @@ Updated rules for managing members across all types of chats in New Expensify. - Auditors are added to #announce when they join the workspace, so they can't leave or be removed from it either - Only workspace admins can post in #announce. Every other role, auditors included, sees the room as read-only -#### Workspace #admin room +#### Workspace #admins room | | Admin | Auditor | | :----------------: | :---: | :-----: | | **Invite** | ❌ | ❌ | From afc8f295837a456398fb9bf5ccd68826b069b98f Mon Sep 17 00:00:00 2001 From: Vit Horacek <36083550+mountiny@users.noreply.github.com> Date: Fri, 18 Sep 2026 12:49:27 +0200 Subject: [PATCH 6/6] Revise SECURITY.md for clarity on roles and permissions Updated the security guidelines to clarify workspace membership rules and reports section. --- contributingGuides/philosophies/SECURITY.md | 40 ++++++++++----------- 1 file changed, 20 insertions(+), 20 deletions(-) diff --git a/contributingGuides/philosophies/SECURITY.md b/contributingGuides/philosophies/SECURITY.md index 4abfa28f7e8d..208307a519b9 100644 --- a/contributingGuides/philosophies/SECURITY.md +++ b/contributingGuides/philosophies/SECURITY.md @@ -33,20 +33,6 @@ Updated rules for managing members across all types of chats in New Expensify. - DM always has two participants. None of the participant can leave or be removed from the DM. Also no additional member can be invited to the chat. ### Workspace Rooms -#### Workspace -| | Creator | Member(Employee/User) | Admin | Auditor | -| :----------------: | :-----: | :-------------------: | :---: | :-----: | -| **Invite** | ✅ | ❌ | ✅ | ❌ | -| **Remove** | ✅ | ❌ | ✅ | ❌ | -| **Leave** | ❌ | ✅ | ❌ | ✅ | -| **Can be removed** | ❌ | ✅ | ✅ | ✅ | - -- Creator can't leave or be removed from their own workspace -- Admins can't leave from the workspace -- Admins can remove other workspace admins, as well as workspace members, and invited guests -- Creator can remove other workspace admins, as well as workspace members, and invited guests -- Members and Auditors cannot invite or remove anyone from the workspace - #### Workspace #announce room | | Member(Employee/User) | Admin | Auditor | | :----------------: | :-------------------: | :---: | :-----: | @@ -112,12 +98,26 @@ Updated rules for managing members across all types of chats in New Expensify. - Domain members can't leave or be removed from their domain chat -4. ### Reports - | | Submitter | Manager | - | :----------------: | :-------: | :-----: | - | **Remove** | ❌ | ❌ | - | **Leave** | ❌ | ❌ | - | **Can be removed** | ❌ | ❌ | +### Reports +| | Submitter | Manager | +| :----------------: | :-------: | :-----: | +| **Remove** | ❌ | ❌ | +| **Leave** | ❌ | ❌ | +| **Can be removed** | ❌ | ❌ | - Report submitters can't leave or be removed from their reports (eg, if they are the report.accountID) - Report managers can't leave or be removed from their reports (eg, if they are the report.managerID) + +## Workspace membership +| | Creator | Member(Employee/User) | Admin | Auditor | +| :----------------: | :-----: | :-------------------: | :---: | :-----: | +| **Invite** | ✅ | ❌ | ✅ | ❌ | +| **Remove** | ✅ | ❌ | ✅ | ❌ | +| **Leave** | ❌ | ✅ | ❌ | ✅ | +| **Can be removed** | ❌ | ✅ | ✅ | ✅ | + +- Creator can't leave or be removed from their own workspace +- Admins can't leave from the workspace +- Admins can remove other workspace admins, as well as workspace members, and invited guests +- Creator can remove other workspace admins, as well as workspace members, and invited guests +- Members and Auditors cannot invite or remove anyone from the workspace