Access model
- Authorization is deny-by-default: a route with no granted scope fails closed.
- Team folders carry MANAGER/EDITOR/VIEWER membership; sub-folder role overrides narrow (never widen) access within a tree.
- Named guests are invited to exactly one folder tree with a revocable one-time link.
Devices & sessions
- Users manage their own device sessions from the Security page.
- Security admins see every active device in the tenant — user, device, IP, last seen — and can revoke a device and its refresh session in one audited action.
Offboarding
- Transfer every file a departing user owns to a successor in one audited operation (Settings → Offboarding).
- Revoke the leaver's devices from the admin session list.
- Folder memberships and share links are deliberately not transferred — review them explicitly.
Staying informed
- The usage dashboard breaks storage down by user and team folder, shows a 14-day activity trend and the most-downloaded content.
- Scheduled email reports deliver the same digest daily or weekly to the recipients you configure.
- The audit trail records every mutation with actor and before/after state.