Authentication activity
Session and sign-in activity available for review
Supports:
Investigation of failed sign-ins and permission changes
Recorded context:
Relevant session, request, and failure context when available
Security design for organization-aware work
Digital Foreman combines authenticated organization context, role and permission checks, scoped data access, and reviewable activity history for supported construction workflows.
Organization-aware requestsRole and permission checksReviewable activity history
Reviewable workflow activity
Supported workflows retain activity context that can help a team investigate changes, delivery failures, and access questions. Available history varies by workflow and configuration.
Time-entry review
Time-entry changes with retained review context
Supports:
Payroll review using the history captured by the workflow
Recorded context:
Before-and-after values, actor, time, and available field context
Project change tracking
Project modifications and status changes
Supports:
Review of project changes, scope questions, and approvals
Recorded context:
Supported project, budget, and timeline changes
Equipment tracking system
Equipment usage and location tracking
Supports:
Review of equipment assignments and reported usage
Recorded context:
Assignments, reported locations, usage hours, and service context
Customer data activity
Customer data access and modifications
Supports:
Review of access and changes in supported customer workflows
Recorded context:
Available actor, change, and timestamp context
Authentication exception review
Recorded authentication failures and permission changes
Supports:
Follow-up on unusual or unsuccessful access activity
Recorded context:
Failed sign-ins, permission changes, and available request context
Document activity history
Document access and modification tracking
Supports:
Document-access and change review where history is captured
Recorded context:
Available access, download, and modification events
Weather context tracking
Weather documentation for warranty review
Supports:
Warranty and material-condition review with recorded context
Recorded context:
Available weather snapshots, constraints, and temperature context
Financial integration activity
Accounting system integration tracking
Supports:
Review of accounting synchronization and delivery failures
Recorded context:
Supported synchronization events, transaction references, and errors
Safety incident reporting
OSHA documentation and safety tracking
Supports:
Safety incident review and documentation follow-up
Recorded context:
Submitted incidents, classifications, and available field context
Conflict resolution system
Sync conflict handling with reviewable state
Supports:
Review of detected conflicts and user-selected resolutions
Recorded context:
Conflict state, resolution choice, and resulting values
Notification delivery tracking
Communication delivery status
Supports:
Notification delivery review and follow-up
Recorded context:
Recipient, time, and provider-reported delivery state when available
Field operations monitoring
Field work tracking and crew accountability
Supports:
Review of submitted field activity and crew assignments
Recorded context:
Available activity, location, timestamp, and assignment context
Sync queue review
Bounded queue processing with visible failure states
Supports:
Review and retry of queued synchronization work
Recorded context:
Sync attempts, batch context, failures, and recovery actions
Data integrity monitoring
Sync health tracking and monitoring hooks
Supports:
Investigation of queue health and processing failures
Recorded context:
Available queue depth, batch, and processing context
Layered access-control design
Access control is applied across request identity, permissions, organization-scoped data paths, and selected audit-backed workflows. Each layer has a distinct responsibility.
Layer 1
Authenticated organization context
Protected requests carry an authenticated organization identity
Source behavior:
Request guards reject missing or malformed organization context
Purpose:
Establishes an organization boundary before protected handlers run
Layer 2
Role and permission checks
Protected operations evaluate the authenticated user context
Source behavior:
Route and service checks gate supported actions by role or permission
Purpose:
Limits supported actions to the access granted to that user
Layer 3
Organization-scoped data access
Tenant-aware service paths include organization identity in data access
Source behavior:
Source contracts and focused tests review adopted query paths
Purpose:
Reduces the risk of a request reading or changing another organization’s data
Layer 4
Reviewable changes
Selected sensitive workflows persist change or delivery evidence
Source behavior:
Fail-closed audit persistence is used where the workflow requires it
Purpose:
Supports investigation without treating source design as live assurance
Control review boundaries
Source checks and focused reviews can identify organization-scope, relationship, and audit-history concerns. Those results describe the reviewed source or data set; they do not establish a current production assurance on this public page.
Organization-scope review
CRITICALExamines adopted source and data paths for organization-scoped access
Action: Records findings for the responsible owner to resolve and re-check
Customer data integrity
HIGHReviews whether sampled customer records retain organization ownership
Action: Reports relationship issues for investigation and repair
Audit trail completeness
HIGHReviews retained audit-history coverage for selected sensitive changes
Action: Flags incomplete audit-history records for investigation
Data orphan detection
MEDIUMIdentifies records without proper organizational ownership
Action: Provides cleanup recommendations for data hygiene
Cross-organization reference review
CRITICALLooks for unexpected references between organization-owned records
Action: Escalates a detected reference for investigation and correction
Review evidence belongs to the source check or governed runtime review that produced it.
Ask for current, environment-specific evidence when that level of assurance is required.
Additional security features
Session controls
Authenticated requests carry user and organization context. Session renewal, expiry, and revocation behavior is handled by the configured authentication path.
Sensitive-data handling
Sensitive integration credentials use protected storage paths, and diagnostics are designed to redact secret-bearing values. Environment-specific storage assurance requires current proof.
Browser response controls
The application defines content-security and related response headers. The active policy and reporting mode depend on the deployed environment configuration.
Request throttling
API middleware supports route-aware throttling and security headers. Effective limits and allowed origins are determined by the active service configuration.
Discuss the security design in a walkthrough
We'll walk through organization scoping, access controls, and reviewable activity history, then identify any deployment-specific evidence your evaluation requires.