01
Partner and admin capabilities are split by role so routine visibility, billing actions, user management, and higher-risk controls do not all sit behind the same permission level.
Public summary
Access control summary
Admin and partner permissions, with multi-factor authentication and separate roles for higher-risk actions.
- Updated
- August 30, 2026
- Scope
- Public summary
- Escalation
- Formal follow-up available
Current control position
Partner authority comes from active server-side membership, role, and location scope rather than editable profile hints. Reporting-only access excludes participant records, and sponsorship alone grants no participant or portal access.
Access control summary · Current public evidence boundary
Current safeguards
What Blacklight currently does
These statements describe implemented controls and their limits in plain language. They are not a certification, legal opinion, or substitute for an institution-specific contract requirement.
02
Sensitive actions require stronger authentication, especially for account changes, partner-access decisions, or administrative overrides.
03
Location-aware and role-aware access boundaries are part of the model so larger organizations can limit what staff see when broader access is not appropriate.
04
Reporting-only users and aggregate-only event organizers do not receive participant records. Operational participant access must be explicitly assigned for a legitimate support need, and sponsorship alone never grants that access.
Next review path
Open the next document only if the review actually needs more
Start with this summary. Then move into the packet, appendix, or formal follow-up only when the reviewer needs a broader or more formal response. Move into partner review when the next useful step is rollout fit, launch scope, and trust review together.
Use the packet when the team needs one concise review document.
Best for a first review share before deeper follow-up starts.
Open trust packetUse the appendix when the reviewer needs deeper technical detail.
Best for retention periods, provider handling, protected tokens, and detailed access controls.
Open technical appendixStart the partner request when trust diligence has become a real rollout decision.
Best when the review now needs program fit, launch plans, and trust questions considered together.
Start partner reviewRequest formal trust follow-up when the public materials are no longer enough.
Best for questionnaire packets, procurement follow-up, or trust-specific requests that need a formal response.
Request access-control follow-up