The Foundation of Your Headquarters
As introduced in our Platform Architecture overview, the Ground Layer provides the secure, governed foundation upon which your entire digital headquarters is built. It is the land and the law.
This layer consists of a sophisticated, 3-tier governance model that gives you precise control over who can see and do what. To understand it, think of your Luklak instance as a secure corporate campus where a user must pass through three distinct security checks to perform any action.
Tier 1: Business Privilege - Your Campus ID Badge
This is the highest level of access. A user’s Business Privilege determines if they are allowed onto the campus at all and defines their maximum potential authority. It’s the first gate everyone must pass.Owner
The highest level. Manages billing and holds all Admin privileges. Can add or remove everyone, including Admins.
Admin
Can configure everything in the system, from users to global settings, but cannot remove the Owner.
App Manager
A specialized role that can design and manage
📋 Functions.Member
The standard privilege for most users to work within
⏹️ Spaces.Tier 2: Item Access - The Keys to the Buildings
Once a user is on campus, Item Access Control determines which specific “buildings” they can enter. These “Items” are high-level containers like a📋 Function, a Dashboard, or a ⏹️ Space. This tier answers the question: “Which workspaces and tools can you access?”
Tier 3: Permission Schemes - The Rules Inside the Building
Once inside a specific building (like a⏹️ Space), the Permission Scheme governs what a user can actually do to the contents (the 🧊 Objects) within. This is the most granular layer of control.
Implementing Tier 3 security is a two-step process that separates design from operation:
Step 1: Design the Scheme (in the Function)
First, as an architect, you design the Permission Scheme as a blueprint inside a 📋 Function. This is where you create your Roles (e.g., “Project Lead,” “Team Member”) and define the rules: which Role can perform which Action (e.g., View Object, Edit Object, Delete Object). This scheme is automatically inherited by every ⏹️ Space created from this Function, ensuring a consistent set of rules.
Step 2: Assign Roles (in the Space)
Then, in a live ⏹️ Space, a manager assigns specific Users or Groups to the Roles that were defined in the Function’s blueprint. This provides ultimate flexibility: the rules are standardized, but who plays which role can be different for each individual Space.