Settings
Autonomy mode, roles, audit trail and the safety posture of this workspace.
Safety posture
Structural, not advisory. Each of these is enforced by a type or a transition table.
Risk scale is inherited
KNOuX Repair's RISK LEVEL 0–3 scale is reused, not redefined. Advertising money and published brand content are at least as consequential as a firewall rule, so one approval model covers the whole institution.
- READ ONLY. Observation and analysis. May be suggested freely.
- LOW-RISK REVERSIBLE. Draft content, internal notes, saved lists. Ask before state changes.
- PRIVILEGED CHANGE. Spends money, publishes publicly, or mutates a live account. Full disclosure plus explicit approval.
- DESTRUCTIVE / HIGH IMPACT. Irreversible or broadly visible brand and budget action. Strongest confirmation and preview.
What this build cannot do
- Spend money. No mutating connector is callable.
- Publish an ad or a post to any real account.
- Send a WhatsApp message.
- Read a private group member list.
- Return a credential to a browser.
- Move a campaign to LIVE without a provider confirmation.
Autonomy
Default COPILOT. Advisor analyses, Copilot prepares actions for a named human, and Autopilot is a reserved slot with no enabling code path.
Roles and permissions
Client scope is checked before any permission, so no role can cross clients.
| Role | Scope | Permissions | Meaning |
|---|---|---|---|
| OWNER | ALL CLIENTS | 31 | Full control of the workspace, including connections and role assignment. |
| MANAGER | ALL CLIENTS | 27 | Runs clients and campaigns. Approves. Cannot change connection secrets. |
| ADS SPECIALIST | ASSIGNED ONLY | 18 | Builds and optimises campaigns. Submits for approval, does not approve. |
| DESIGNER | ASSIGNED ONLY | 15 | Produces creative drafts. No campaign budget access. |
| CONTENT CREATOR | ASSIGNED ONLY | 17 | Produces and schedules content. No campaign budget access. |
| CLIENT | OWN CLIENTS ONLY | 15 | Sees only their own workspace. Approves plans submitted to them. Read-only elsewhere. |
| VIEWER | ASSIGNED ONLY | 12 | Read-only across the workspace. Cannot approve or change anything. |
Separation of duties
An approval record only proves something if the approver is not the author.
Campaign approval
- The author of a plan cannot approve it.
- Approval is granted over a frozen budget, duration and target snapshot.
- Approval is held by Owner, Manager, or the client themselves.
- Approval does not spend money. Launch is a separate, connector-gated step.
Connection credentials
- Reading connection state is ordinary operator work.
- Changing where a credential comes from is restricted to the workspace owner.
- Tokens are never written to local storage and never serialised into a response.
Audit trail
Sensitive operations are recorded. Secrets are never recorded.
Recorded action types
Entries for SwimFit Academy
- CAMPAIGN SUBMITTED 2026-10-03 09:12 · ads.specialist@knoux.storeBudget AED 750.00 over 8 days, target Abu Dhabi, objective Leads. Submitted for approval.
- AI RECOMMENDATION ACCEPTED 2026-10-02 11:05 · ads.specialist@knoux.storeAccepted a suggestion to narrow the radius to 8km. Applied to the draft.
- COMMUNITY POST DISTRIBUTED 2026-09-30 17:22 · operator@knoux.storeOperator marked the post as posted in Khalifa City Community after posting manually.
Environment
Names only. This screen cannot read a value.
The browser is never sent a provider credential. Configuration is read server-side and projected as presence counts, capability names and env var names.
One intelligence. Every channel, every client. KNOuX reasons through the KNOuX Intelligence layer; Meta and Google are connectors, not the brain. No campaign can spend without a named human approving a frozen budget.