Architecture & Access Control• Clerk Organizations

Team Access & Multi-Tenancy

Learn how Pillar utilizes Clerk Organizations to provide seamless team access, isolated multi-tenant boundaries, role management, and multi-facility switching for post-production engineering teams.

1. Shared Dashboard Access Overview

In Pillar, access is organized around your Studio Organization. Rather than sharing individual credentials or passing around server SSH keys, every engineer authenticates with their own identity (via email or Google sign-in) and joins your shared organization. Enterprise SSO (SAML/OIDC) is available as a custom-priced add-on — contact us to scope a plan.

All team members in an organization have unified, real-time visibility into the same storage nodes, tail-latency telemetry, degraded drive alerts, and capacity forecasts. Team-seat and appliance limits are specified in your plan or Order Form.

2.How to Invite Team Members

Organization administrators can invite technical directors, storage engineers, and operations staff in seconds:

Open the Organization Switcher

In the top-right corner of the Pillar dashboard, click your active Organization Name or avatar dropdown.

Select 'Manage Organization'

Click the settings gear icon or select 'Manage Organization' to view members, active invitations, and permissions.

Send Email Invitations

Enter the corporate email addresses of your Storage Engineers, Systems Administrators, or Technical Directors. Assign their organization role (Admin or Member) and click Send Invitation.

Instant Unified Access

When an invited engineer clicks the link in their invitation email and signs in, their session automatically binds to your studio fleet with zero manual API key or server token distribution required.

3.Role Permissions (Six Roles)

A person's Clerk organization role sets their default Pillar role when they join. Organization Admins can override any individual's role in Settings → Users & roles, with a full audit trail. Roles are additive permission sets — Organization Admin holds every permission:

Capability	Viewer	Operator	Facility Admin	Org Admin	Billing Admin	Security Auditor	Details
View fleet & real-time telemetry	Yes	Yes	Yes	Yes	Yes	Yes	Disk latency, pool capacity velocity, and IOPS charts.
View chargeback reports	Yes	Yes	Yes	Yes	Yes	Yes	Read-only project/client cost allocation views.
View security posture reports	Yes	Yes	Yes	Yes	Yes	Yes	Read-only technical deployment-control evidence.
Acknowledge, note & resolve incidents	—	Yes	Yes	Yes	—	—	Own the incident lifecycle on open alerts.
Manage facility settings & workload profiles	—	—	Yes	Yes	—	—	Operating hours, codec profiles, context mappings.
Manage alert rules & integrations	—	—	Yes	Yes	—	—	Thresholds, notification routing, third-party integrations.
Generate node pairing tokens	—	—	Yes	Yes	—	—	15-minute one-time enrollment tokens for new appliances.
Export security posture evidence	—	—	Yes	Yes	—	Yes	Export technical posture evidence; not an external certification.
Manage users & role overrides	—	—	—	Yes	—	—	Settings → Users & roles; assign manual role overrides.
Manage billing, subscription & chargeback rules	—	—	—	Yes	Yes	—	Stripe Customer Portal and chargeback rule configuration.

4. Multi-Facility Switching for Senior Technical Directors

If your engineering team oversees multiple independent facilities, stages, or subsidiary studios (for example, Company Chicago and Company LA), each location can be created as a separate Organization in Clerk.

•Organization-scoped data: Each organization possesses its own dedicated pairing tokens, storage nodes, disk telemetry history, and alert routing policies.

•One-Click Switcher: Use the organization switcher dropdown in the dashboard header to immediately jump between facility views without logging out.

5.Multi-Tenant Security & Data Boundary Controls

Tenant Database Partitioning

PostgreSQL clerk_org_id Foreign Keys

Storage nodes, telemetry, alerts, and pairing tokens are scoped to studio records. The application resolves authorization server-side and applies the selected studio scope to its queries.

Cross-Tenant Access Controls

Server-Side Session Resolution

Dashboard pages and API routes resolve the user's current Clerk membership server-side before allowing studio-scoped access. Authorization failures are denied rather than served from a cached membership result.

Node Enrollment Credentials

Outbound Edge Daemon Token Binding

The standard pairing flow uses short-lived enrollment tokens and outbound TLS 1.3 telemetry. Administrators remain responsible for their host access controls and deployment review.

Multi-Facility Switching

Clerk Organization Switcher

Engineers managing multiple facilities (e.g., 'Chicago Editorial' and 'NYC Finishing') can seamlessly switch active organizations from the top navigation bar without logging out.

6. Access Revocation & Deprovisioning

Pillar does not cache organization membership. Every authorization check confirms the requesting user against Clerk's live organization membership before granting access. When an admin removes someone from the Clerk organization, access is denied on that user's next authorization check after Clerk reflects the removal — not necessarily the instant the removal is clicked.

•Open browser tabs: A dashboard page already loaded in a browser remains visible until it makes its next request — closing or reloading the tab is what triggers the denial.

•Corporate identity providers: Deactivating someone in your corporate IdP (Okta, Azure AD, Google Workspace, etc.) does not by itself remove their Clerk organization membership. Unless your Clerk connection is configured to sync removals, an admin must also remove the person from the Clerk organization for Pillar access to be revoked.

•Clerk unreachable: If Pillar cannot reach Clerk to confirm membership, it denies the request rather than falling back to any cached membership record. Availability of the authorization check is coupled to Clerk's availability.

•Manual role overrides: A role override set in Settings → Users & roles stops applying when that person is removed from the organization. If they are re-invited later, they return with the default role derived from their Clerk org role until an admin sets a new override.