Permission levels
How role-based access works — each connect link or access token is issued at a permission level that controls how much personal data the assistant can see.
Access in Kula is controlled by rules and roles. When you create a connector in app.kula.digital, you set a permission level for it. That level travels inside the credential — a connect link for Claude, or an access token for other clients — and controls how much personal information the assistant can ever see.
Redaction happens on our server, so a credential can't be talked into revealing more than its level allows. The level is the cap, set by you, per person.
Rule of thumb: give each person the lowest level that lets them do their job. You can always create a second connector at a higher level for a specific task.
The four levels
Analytics
No (aggregates only)
No
No
No
Operations
Yes
No
No
No
Admin
Yes
Yes
No
No
Full
Yes
Yes
Yes
Yes — every call
If an action needs a higher level than the credential holds, it returns a clear error (scope "analytics" cannot call …) and nothing leaks — the assistant simply can't see it.
Narrow further: hide the books
The four levels control how much personal data a credential sees. You can also exclude a whole category of data on top of the level — independent of which level you picked.
Today there's one such option: Hide the books. Tick it when you create a connector and that credential can never read your accounting ledger — the chart of accounts, journals, entries, and invoice lines. Your commerce data — sales, payments, and refunds — stays fully visible, so the assistant can still answer revenue and membership questions; it just can't open the general ledger.
It's enforced the same way as the levels: server-side, on every query. A credential set to hide the books gets a clear denial if it tries to read any accounting table, and nothing leaks. Use it for, say, a front-desk or operations login that should see who paid and when, but not the studio's books.
Hide the books is set per connector, like the level, and shown on the credential's card under Connectors so you can see at a glance which logins have it. The split between commerce and accounting is the same one in the schema reference.
Which level for which role?
Analytics — trends and totals, no individuals. Good for a shared dashboard or a public stat ("our retention was 78% this quarter").
Operations — names visible, contact details hidden. The everyday default for an owner or coach asking "who should I check in with?"
Admin — emails and phones visible, so the assistant can draft outreach to specific people. Payment details still hidden.
Full — reveals sensitive records like card fragments. Every use is recorded for your own audit trail. Reserve it for a compliance export or a formal data request — a fire extinguisher, not a light switch.
Good habits
One connector per person or assistant. Separate connectors give you a separate trail for each, and you can revoke one without breaking the others.
Match the level to the role, not to convenience. Don't hand out Admin "just in case."
Treat connect links and tokens like passwords — don't paste them into a chat or commit them to code.
Revoke when someone leaves or changes role. Revoking a connector in app.kula.digital stops its access within about a minute.
Where to manage access
Everything lives under Connectors in app.kula.digital: create a connector at the right level, see what each is for, and revoke any of them with one click.
Related
Connect Claude — where the connect link goes.
Is my data safe? — the plain-English safety summary.
Security & data handling — the technical detail.
Last updated
Was this helpful?