Access Control Policy

Owner: Ivy, Founder, Koda Digital · Contact: contact-us@kodadigital.ai · Effective: 2026-09-03

1. Principle

Least privilege, enforced by the platforms' native role systems rather than by convention. Every identity has the minimum role needed; there are no shared accounts.

2. Roles (RBAC)

Role Who / what Granted via Rights
Operator (Owner) Ivy — the single human Google Cloud IAM roles/owner on koda-finance-e1c74; Plaid dashboard Owner Deploy code, manage secrets, read Firestore, manage Plaid Items
Backend service account Cloud Functions runtime SA IAM, managed by Firebase Read/write Firestore; access the three secrets; call Plaid
End user (app) The same human, via the app API key Read aggregated balances/transactions; link/unlink Items; edit manual assets
Plaid Plaid's systems Plaid credentials Serve financial data on request; no access to Koda systems

No other principal has any access. Firestore security rules deny all client access (firestore.rules), so the only path to data is through the backend service account.

3. Granting access

Access is granted only by the Operator, only through IAM or the Plaid dashboard (never by sharing credentials), and only after the requester and purpose are recorded in access-review-log.md. As of the effective date, no access has ever been granted to a second person.

4. Periodic access reviews

Every 6 months (and immediately after any incident or architecture change) the Operator reviews and records in access-review-log.md:

  1. Google Cloud IAM members and roles on the project (gcloud projects get-iam-policy or the console).
  2. Plaid dashboard team members and their roles.
  3. Enabled service accounts and their keys (none should have user-managed keys).
  4. Secret Manager secret versions (destroy superseded versions).
  5. GitHub repository collaborators.
  6. Devices with the app installed and Google account sessions (Google Security Checkup).

5. De-provisioning / modification of access

With a single operator there are no employees to terminate or transfer. Structurally, however, all access is tied to identities that can be revoked in one place:

  • Removing a Google IAM member instantly revokes Cloud/Firebase/Firestore/Secret Manager access.
  • Removing a Plaid dashboard member instantly revokes Plaid access.
  • Rotating the API key (Secret Manager + app rebuild) revokes every installed app copy.
  • Plaid Items are revoked with /item/remove via the app's unlink function.

Before adding any second person, this section will be replaced with a joiner/mover/leaver procedure with a same-day revocation SLA, and access will be granted through Google Groups so removal is a single group change.

6. Workstation and account hygiene

  • Google account: 2-Step Verification with a passkey/security key; recovery options reviewed at each access review.
  • Plaid dashboard: MFA enabled.
  • Development machine: full-disk encryption, OS auto-updates, screen lock; secrets are stored only in Secret Manager and local gitignored .env.local files.