Waypoint Suites / Organization Portal
Access questions get an answer, not an estimate
People, permissions, clients, deployments, invoicing, contacts and the audit log — the administrative surface behind whichever portals your organization has bought.
Seventeen pages whose real job is answering, in writing, who may do what and when they were granted it. That question stalls more carrier audits than any missing feature.
Walk an access reviewProblem 1 — Permission creep
Access that grew by exception, explained
Entitlements
What exists at all
The organization’s entitlements decide which portals and pages are real for you. Unbought means unreachable, whatever a role says.
Permissions
What a person may do
Roles are per-portal, so somebody doing two jobs holds two roles rather than one broad one.
Users
Who they are
Forced reset on first sign-in, TOTP enrolllment, SSO federation, and a denylist so a revoked session stops working immediately.
Problem 2 — Proving it
The audit answer already exists
Audit Log
Who, what, when, why
Recorded as it happens, not reconstructed on request.
Contacts
Merged, not overwritten
The same customer on a second claim is recognized; a merge preserves both histories.
Clients
Relationships, kept
Clients and agencies terminate rather than delete, so history survives the relationship.
Reporting
Answers on demand
Reporting, analytics and predictive panels, each scoped by the caller’s own permissions.
Tenant isolation
Two walls, because one of them is written by people
The application resolves your organization from the session and scopes every query to it — a request cannot name a different organization, because the value is never accepted from the client. Underneath, PostgreSQL row-level security is enabled and forced on tenant tables, applied by the database engine for every connection including administrative ones.
Application scope
Organization resolved from the session, never from the request.
Forced RLS
Enabled and forced on tenant tables, for every connection.
Encryption
Personal information encrypted at the application layer, searchable via a keyed blind index.
Machine identities
Service principals cannot be assigned to a person or log in interactively.
Role catalog — shared with the Claims Platform
Custom exists because no shipped catalog survives contact with a real organization chart. What Custom cannot do is escape the entitlement check above it.
Offboarding revokes the role and denylists the session token, so a token already sitting in somebody’s browser stops being accepted rather than living until it expires.
What it solves
Every grant and revocation writes an audit row through one controlled path, with actor, timestamp and reason.
Entitlements and per-portal roles are queryable state, not an assembled narrative.
Contacts de-duplicate across claims and merge, keeping both records’ history.
Revocation denylists the token, so it stops being accepted immediately rather than at expiry.
Two independent walls: application scoping, and forced row-level security applied by the database for every connection.