Real access, inside the lines you draw
Write access is what makes org.run useful, and what makes a security team nervous. So org.run never has more reach than the person it acts for, and anything that matters waits for a person to say yes.
Least privilege
Never more reach than it needs
Mirrors your org
Permissions follow your org chart and roles, so org.run can only do what the person it acts for could do.
Scoped to the task
Each run gets only the access that task needs, for as long as it needs it, and nothing carries over to the next.
Credentials stay sealed
Passwords and tokens never reach the model. org.run uses them without ever seeing them.
Start read-only
Connect your tools with read access first. Turn on writes one system and one action at a time, as trust grows.
Limits in plain numbers
Set the line by amount, account or customer: refunds up to $500 on their own, anything above that to finance.
Delegation with limits
When someone is away, their delegate decides only within the window and the limits they were given.
Where it stops
Auto, ask or never
You sort every kind of action into one of three tiers. org.run follows the line you draw.
Done on its own
Routine, low-risk work it handles end to end, then logs.
Example
Reply to a routine support ticket
Waits for a person
It prepares the work, then stops for your sign-off before anything goes out.
Example
Issue a refund over $500
Off limits
Actions it will not take, whoever asks and however it is phrased.
Example
Delete customer data
Lines you can draw
Say it in a sentence, org.run follows it
Rules are written the way you would explain them to a new hire, and they hold whoever asks and however it is phrased.
- Never send a payment over $10,000 without the CFO
- Ask before emailing a customer on an enterprise plan
- Never delete customer data
- Refunds under $200 can go out on their own
- Ask before changing anything in production
- Only the account owner can approve a discount
- Never share a contract outside the company
- Ask before any change to payroll
Questions about access and approvals
No. Every kind of action sits in a tier you set. Anything in Ask waits for a person, and anything in Never is refused, whoever asks.
Rules are enforced outside the conversation, so no prompt or phrasing can move an action out of its tier.
Yes. Most teams start read-only, watch what org.run would have done, then turn on writes one action at a time.
Only the people you give that right to. Everyone else can read the rules but cannot change them.
More on security
The rest of the picture
Data protection
Encrypted everywhere, isolated per run, never used for training and kept for as long as you decide.
Read moreAudit and oversight
A receipt for every action and a record for every decision, with writes you can roll back.
Read moreDevice security
org.run Desktop on Mac and Windows: central policy, consent from every person and nothing sensitive recorded.
Read moreEarly access
Draw the lines Then let it work
Start read-only, set the tiers and widen access as org.run earns it.
Scoped, auditable and reversible from day one. Your data stays yours.