Identity Model
Bitment's identity model is closer to a social network than a traditional single-tenant login system. This page explains the underlying structure for an administrator who needs to reason about who can see what, rather than just click through the settings screens. For the day-to-day settings themselves, see Firm and team.
Where to find it
The pieces described here surface in a few places: Settings › Firm for firm/team management, the account dashboard behind your avatar for your own identity and security settings, and the Engineers console (Bitment team only) for impersonation and diagnostics consent.
Key concepts
- Individual: one real person's account, no matter how many firms or roles they touch.
- Verified email: an email address proven to belong to an individual; one individual can hold several.
- Group: a firm: a collection of individuals, the unit of team permissioning and shared ownership.
- Membership: the link between one individual and one group, carrying exactly one relationship.
- Relationship: the role that membership represents: operator, client, referrer, or engineer.
- Client group: the record of which firm(s) a given CRM client belongs to.
Individuals are the account, not the login
An Individual is one real person's account. What makes this different from a typical login system is that an individual can hold several verified email addresses at once, all resolving to the same account: signing in with any one of them lands you in the same place, with the same settings, the same two-factor setup, and the same history. This matters in practice when a person uses a personal address and a work address interchangeably, or moves between addresses over time.
Groups are firms
A Group is a firm: a collection of individuals, modeled the way a code-hosting platform models an organization. A group is the unit of:
- Team permissioning: "share this with my team" means sharing with the group.
- Team administration: roles, invitations, and member management all happen at the group level.
- Shared resources: things owned by the firm rather than by one person, like a shared AI credential or a connected messaging workspace, belong to the group.
Memberships tie an individual to a group with a relationship
A Membership connects one individual to one group, and every membership carries exactly one relationship:
| Relationship | What it means |
|---|---|
| Operator | A member of the firm's own team, using Bitment to run the firm and serve clients. |
| Client | Someone the firm serves, using the client portal to view files, sign documents, fill forms, or work their own books. |
| Referrer | A partner outside the firm who refers clients to it. |
| Engineer | A member of the Bitment team itself, with oversight tooling separate from any one firm. |
One individual can hold memberships with different relationships at different firms, or even different relationships at the same firm: someone can be an operator at one firm and, separately, a client of another, all under the same account.
Operator sessions span every firm at once
An operator's session is not scoped to a single firm. One operator workspace spans every firm that individual operates in: there's no workspace switcher to click through to move between firms you belong to, and nothing is duplicated per firm. Items owned by a specific firm carry a badge naming it, and creating something shared asks which firm should own it. This is why the model reads more like a social graph than a conventional multi-tenant login: your operator identity is one continuous thing across every firm you touch, not a separate account per firm.
Client and referrer sessions work differently: they stay scoped to a single firm at a time, matching how a client or referrer actually relates to a firm, one relationship at a time.
Client groups: how a client can belong to more than one firm
A CRM client record can be linked to more than one firm at once, tracked as its client group memberships. This is how a client that's genuinely served by two different firms in your network (for instance, a client of both a CPA firm and a related advisory firm) stays visible and correctly scoped to each firm that has a legitimate relationship with it, without duplicating the client record.
Impersonation ("view as")
The Bitment team has a diagnostic tool, reachable from the engineers console, that lets an engineer load an operator's workspace exactly as that operator sees it: a "view as" session. This exists to diagnose a problem a firm is reporting without asking them to walk through it step by step.
Two things govern it:
- It requires the target individual's consent. An individual has to have opted in to diagnostic access from their own account settings before "view as" is available against their account at all; without that opt-in, the engineer's request is refused.
- You know when it's happened. The moment the underlying session is an impersonation session, the operator interface shows a visible banner for as long as it's active.
Two-factor authentication (coming soon)
Two-factor authentication is coming soon. It will be enrolled once per individual, not once per email address, so it protects the account regardless of which verified email you sign in with. Once enrolled, a password sign-in will be followed by a code from an authenticator app or a text message before the session completes.