Apivom Mask — the right people see the right records
Mask is the fine-grained authorization layer inside the Apivom products. It decides, record by record, who owns it, which team can see it and when access is company-wide. Mask is included with the products and is not sold separately.
Infrastructure layerMask in numbers
Roles say what you can do. Mask says on which records.
Access follows relationships between people and records, so a person sees their own work and their team’s, and anything wider is a deliberate choice.
Relationship-based access
Every record is linked to its owner and team. Access follows those links, so what a person sees comes from who they work with and what they own.
Own and team records
A person sees the records they own and the records of their team. The owner has full control, and a team can be given view or edit access.
Company-wide scope on request
Seeing or editing across the whole company is an explicit grant, given per page. It is never the default.
One store per organisation
Each customer organisation has its own authorization store, created when the organisation is set up.
Checks that fail closed
If an access check does not get an answer within 5 seconds, it is denied. A slow or unavailable check never opens a record.
Kept in step with your records
Ownership is recorded when a record is created, set again when it is reassigned and removed when it is deleted.
How the Apivom products use Mask
You do not set Mask up on its own. It runs inside Iris, where it decides which records a person may see or edit. Other products rely on role-based capabilities instead. Here is where it applies today.
- Iris record scoping. Mask scopes 17 record types in Iris, from opportunities, companies and quotes to invoices and tickets. Each is tied to an owner and a team.
- Company-wide scope grants. Viewing or editing across the whole company is granted per page, and a page can also be opened to everyone in the organisation.
- Customer portal. A customer in the Iris portal sees their own company’s support tickets and nothing else.
- Other products. Pivot relies on role-based capabilities, so record-level scoping from Mask does not apply there.
Access that closes when a check cannot finish
Mask is built to refuse when it is unsure. A check that cannot complete is denied, deleting is limited to the owner, and access to a parent company does not become the right to edit its subsidiaries.
- Fails closed. When the check does not answer within 5 seconds, the request is denied.
- Owner-only delete. Only the owner of a record can delete it. Team and company-wide grants cover viewing and editing.
- Parent and subsidiary companies. Viewing a parent company extends to its subsidiaries. Editing and deleting never do.
Frequently asked questions
What is Apivom Mask?
Mask is fine-grained authorization. It is relationship-based access control: every record is linked to its owner and team, and Mask uses those links to decide which records a person may see or change. People see their own and their team’s records, and company-wide access is an explicit grant.
Is Mask sold separately?
No. Mask is an infrastructure layer that is included with the Apivom products. You do not buy or set it up on its own. If you want to know how access to records would work for your teams in Iris, talk to us.
How is Mask different from roles in Key?
Key is who you are: sign-in, organisation and roles. Mask is which records you may see or change, based on relationships such as owner, team or a company-wide grant. Roles are not copied into Mask, which recognises a person by their Key account. Manager, director and admin roles are handled through the role itself, and Mask scopes the rest.
What happens when a record is reassigned?
Ownership is a relationship recorded on the record. It is written when the record is created, set again when the record is reassigned, and removed when the record is deleted. Access then follows the new owner and team rather than staying with the previous one.
What happens when an access check cannot complete?
Mask fails closed. If a check does not get an answer within 5 seconds, access is denied instead of being allowed. A slow or unavailable check never opens a record by accident.
Which products use Mask?
Today Mask is used inside Iris, where it scopes 17 record types such as opportunities, companies, quotes, invoices and tickets. Pivot relies on role-based capabilities instead. Each customer organisation gets its own authorization store when it is set up.
Access that follows your records
Mask comes with the Apivom products. Talk to us about how your teams should see and share records.