Ascend Capital LLC

Security Permissions Audit

Complete overview of entity RLS and function access controls across Ascend Capital

8

Entities Audited

All standardized
4

Admin-Only Functions

Critical
100%

Deletes Protected

Admin only
2

Public Creation Points

Intentional

Entity-Level Security (RLS)

FundingApplication

Public Submission

Public

Owner/Email/Admin

Owner/Email/Admin

Admin

PortfolioSubmission

Public Submission

Public

Owner/Email/Admin

Owner/Email/Admin

Admin

InvestorMessage

Email-Based

Email Owner/Admin

Email Owner/Admin

Email Owner/Admin

Admin

ApplicationNotification

System-Generated

Admin Only

Recipient/Admin

Recipient/Admin

Admin

InvestorProfile

User-Owned

Owner Only

Owner/Admin

Owner/Admin

Admin

ApplicantMessage

Cross-Entity

Application Owner

Application Owner/Admin

Application Owner/Admin

Admin

Distributor

Public Signup

Public

Owner/Email/Admin

Owner/Email/Admin

Admin

DealRoomAccess

Admin-Controlled

Admin Only

Granted User/Admin

Admin Only

Admin

Backend Function Access Control

🔴 Admin-Only Functions (Critical)

analyzePortfolio

Admin Only

AI risk analysis of debt portfolios

Database Impact: Updates PortfolioSubmission with risk scores

exportReports

Admin Only

Export CSV reports of applications

Database Impact: Read-only data export

processReferralCommission

Admin Only

Calculate referral commissions

Database Impact: Updates Referral records

applicationStatusChanged

Admin Automation

Workflow on status changes

Database Impact: Creates notifications, updates records

🔵 Authenticated User Functions

checkEligibility

Authenticated Users

AI funding eligibility assessment

Database Impact: No database writes

extractFinancialData

Authenticated Users

Extract metrics from bank statements

Database Impact: Updates FundingApplication

🟡 Public/Anonymous Functions

trackDistributorVisit

Public (Anonymous)

Log distributor link clicks

Database Impact: Creates DistributorReferral entry

Security Principles
✓ Delete Protection: All delete operations require admin role
✓ Email Isolation: Users can only access records with their email
✓ Admin Verification: Critical functions check user.role === 'admin'
✓ Cross-Entity Lookups: Related records verify parent ownership
✓ Public by Design: Specific endpoints intentionally public (e.g., applications, tracking)
Sensitive Data Access: Portfolio Submissions
Who Can Trigger Analysis?

Admins only via analyzePortfolio function

Who Can View Results?
  • Portfolio creator (via created_by)
  • Portfolio email owner (via data.email)
  • Admins (full access)
Access Restrictions?

Users cannot view other users' portfolios. Email-based isolation enforced.

Full Details: See SECURITY_AUDIT.md in the project root for complete RLS configuration and implementation guide.