Skip to content

[No QA] Document the Auditor role in the security philosophy #101433

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mountiny wants to merge 4 commits into
base: main
Choose a base branch
from
+36 −24
Open

[No QA] Document the Auditor role in the security philosophy #101433

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
a8ffa51
Document Auditor role membership rules in the security philosophy
mountiny Sep 17, 2026
8e3d6b0
Correct the Auditor rules for #admins and expense chats against the A…
mountiny Sep 17, 2026
c52a545
Fix the Auditor rule for user-created workspace rooms
mountiny Sep 17, 2026
b9698ad
Mark auditors as non-removable from #admins to match the automatic-me…
mountiny Sep 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
60 changes: 36 additions & 24 deletions contributingGuides/philosophies/SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@ Updated rules for managing members across all types of chats in New Expensify.
- Admins MUST NOT be able to leave or be removed from expense chats
- Members MUST NOT be able to leave or be removed from the #announce room
- Admins MUST NOT be able to leave or be removed from #admins
- Auditors MUST NOT be able to leave or be removed from #admins
- Domain members MUST NOT be able to leave or be removed from their domain chat
- Report submitters MUST NOT be able to leave or be removed from their reports
- Report managers MUST NOT be able to leave or be removed from their reports
Expand All @@ -33,12 +34,12 @@ Updated rules for managing members across all types of chats in New Expensify.

### Workspace Rooms
#### Workspace
| | Creator | Member(Employee/User) | Admin | Auditor? |
| :----------------: | :-----: | :-------------------: | :---: | :------: |
| **Invite** | ✅ | ❌ | ✅ | ❌ |
| **Remove** | ✅ | ❌ | ✅ | ❌ |
| **Leave** | ❌ | ✅ | ❌ | ✅ |
| **Can be removed** | ❌ | ✅ | ✅ | ✅ |
| | Creator | Member(Employee/User) | Admin | Auditor |
| :----------------: | :-----: | :-------------------: | :---: | :-----: |
| **Invite** | ✅ | ❌ | ✅ | ❌ |
| **Remove** | ✅ | ❌ | ✅ | ❌ |
| **Leave** | ❌ | ✅ | ❌ | ✅ |
| **Can be removed** | ❌ | ✅ | ✅ | ✅ |

- Creator can't leave or be removed from their own workspace
- Admins can't leave from the workspace
Expand All @@ -47,35 +48,43 @@ Updated rules for managing members across all types of chats in New Expensify.
- Members and Auditors cannot invite or remove anyone from the workspace

#### Workspace #announce room
| | Member(Employee/User) | Admin | Auditor? |
| :----------------: | :-------------------: | :---: | :------: |
| **Invite** | ❌ | ❌ | ❌ |
| **Remove** | ❌ | ❌ | ❌ |
| **Leave** | ❌ | ❌ | ❌ |
| **Can be removed** | ❌ | ❌ | ❌ |
| | Member(Employee/User) | Admin | Auditor |
| :----------------: | :-------------------: | :---: | :-----: |
| **Invite** | ❌ | ❌ | ❌ |
| **Remove** | ❌ | ❌ | ❌ |
| **Leave** | ❌ | ❌ | ❌ |
| **Can be removed** | ❌ | ❌ | ❌ |

- No one can leave or be removed from the #announce room
- Auditors are added to #announce when they join the workspace, so they can't leave or be removed from it either
- Only workspace admins can post in #announce. Every other role, auditors included, sees the room as read-only

#### Workspace #admin room
| | Admin |
| :----------------: | :---: |
| **Invite** | ❌ |
| **Remove** | ❌ |
| **Leave** | ❌ |
| **Can be removed** | ❌ |
| | Admin | Auditor |
| :----------------: | :---: | :-----: |
| **Invite** | ❌ | ❌ |
| **Remove** | ❌ | ❌ |
| **Leave** | ❌ | ❌ |
| **Can be removed** | ❌ | ❌ |

- Admins can't leave or be removed from #admins
- Auditors are added to #admins when they are given the Auditor role, and membership follows the role rather than manual invites
- Auditors can read and comment in #admins. Unlike #announce, the room has no admins-only write capability
- No one can leave #admins, auditors included
- Auditors lose #admins when their role changes to one that has no #admins access. That is a role change, not a removal from the room

#### Workspace rooms
| | Creator | Member | Guest(outside of the workspace) |
| :----------------: | :-----: | :----: | :-----------------------------: |
| **Invite** | ✅ | ✅ | ✅ |
| **Remove** | ✅ | ✅ | ❌ |
| **Leave** | ✅ | ✅ | ✅ |
| **Can be removed** | ✅ | ✅ | ✅ |
| | Creator | Member | Auditor | Guest(outside of the workspace) |
| :----------------: | :-----: | :----: | :-----: | :-----------------------------: |
| **Invite** | ✅ | ✅ | ✅ | ✅ |
| **Remove** | ✅ | ✅ | ✅ | ❌ |
| **Leave** | ✅ | ✅ | ✅ | ✅ |
| **Can be removed** | ✅ | ✅ | ✅ | ✅ |

- Everyone can be removed/can leave from the room including creator
- Guests are not able to remove anyone from the room
- Auditors are added to the workspace rooms that are not private when they are given the Auditor role. Private rooms are skipped, so they join those by invitation only
- Auditors are able to invite and remove other participants in the rooms that their role shared with them

#### Expense chats
| | Admin | Member(default) | Member(invited) |
Expand All @@ -90,6 +99,9 @@ Updated rules for managing members across all types of chats in New Expensify.
- Invited members(invited by members) are not able to invite or remove from the expense chat
- Invited members(invited by members) are able to leave the expense chat
- Default members and admins are able to remove invited members
- Auditors are added to every workspace expense chat, so they can see the expenses on the workspace, and they are able to comment
- Auditors are not able to be removed from an expense chat
- Auditors are able to leave another member's expense chat, but not their own

### Domain chat
| | Member |
Expand Down
Loading