Company governance and access requests
Manage company roles, the workspace directory and employee access.
This guide applies to Clowld Space deployments with company governance enabled. Company identity controls company administration; workspace roles still control actions inside each workspace.
Roles and workspace access
| Identity | Company actions | Default workspace access when granted |
|---|---|---|
| CEO | Create workspaces, appoint or revoke Directors, manage company workspaces | owner in all workspaces |
| Director | Create workspaces, view company roles, manage company workspaces | admin in all workspaces; existing owner access is preserved |
| Employee | Browse the company directory and request access | member after approval |
New workspaces also add current CEOs and Directors. These are initial grants; workspace roles can subsequently be edited independently.
Revoking a Director does not remove existing workspace memberships or permissions. Review each workspace's member settings separately when removing access. A workspace must retain at least one owner.
Administration
- Open Settings → Company overview to see the company name, email domains, CEO and workspaces.
- Open Company members to inspect company roles. Only the CEO can appoint or revoke Directors. The employee must have signed in before appointment and use a configured company email domain.
- Create a workspace or switch its policy between Allow requests and Invite only in the overview. That workspace's
ownerandadmincan also manage its access policy.
Directory visibility exposes directory information, not access to issues, comments or files.
Requesting and reviewing access
Employees without a workspace enter Choose workspace, search the directory, optionally give a reason and apply. Pending requests can be withdrawn; rejected or withdrawn requests can be submitted again.
Workspace owners and admins review Join requests in settings, approve or reject with an optional reason, and inspect history. Approval adds the employee as a member.
Direct invitations remain available. Accepting one marks a pending request for the same workspace as joined by another method. An external email allowlist entry alone does not grant company-directory access; use a direct invitation.
Self-hosting
| Variable | Purpose |
|---|---|
CLOWLD_COMPANY_GOVERNANCE_ENABLED | Set exactly to true to enable governance |
CLOWLD_COMPANY_NAME | Display name; defaults to Company |
CLOWLD_COMPANY_EMAIL_DOMAINS | Company domain list; falls back to ALLOWED_EMAIL_DOMAINS when empty |
CLOWLD_COMPANY_CEO_EMAIL | Initial CEO email; initialized when the matching account loads its company identity |
These settings do not replace signup, email or invitation configuration. Missing controls usually require checking deployment settings and identity; appointment also requires an existing account and a company domain. See authentication and environment variables.
This page describes current code. It does not certify every deployment's acceptance checks. See the version guide for release boundaries.