How domain-based access works

Tooling Metrics holds sensitive shop data — cutting parameters, cost structures, purchasing history — that a company has no interest in exposing to strangers, including other companies that happen to sign up for the same product. The sign-up design exists to guarantee that separation automatically, without relying on every new user remembering to configure it correctly.

What this gets you

• No accidental duplicate organizations. Every sign-up is matched to your company by email domain automatically, before any new Organization is ever created. Two people from acme.com signing up independently — say, from different departments, weeks apart, neither aware the other did it — still land in the same place. There’s no way for your company’s data to end up split across two disconnected Organizations just because someone signed up without checking first.
• One source of truth. Because everyone from your company is routed to the same place, your tool data, cost history, and purchasing records stay in one Organization instead of fragmenting across separate accounts nobody remembers to consolidate later.
• Access is controlled, not assumed. Signing up requires owning and confirming a real mailbox on a domain your company manages — knowing the email format gets nobody in. And even a confirmed account has to be reviewed and approved by the site owner before it can see anything.

Every user belongs to a site, keyed by email domain

A Site is the top-level grouping every user belongs to, and it’s identified by nothing more than the domain half of a work email address. When you sign up, Tooling Metrics doesn’t ask which company you’re from — it reads it, from you@yourcompany.com. Anyone who confirms an account with an @yourcompany.com address joins the same Site.

This is deliberate: a domain is something a company controls, not something an individual user can spoof or misdeclare at sign-up. It’s the one piece of identity Tooling Metrics can trust without asking anyone to vouch for it.

Site and organization are two different boundaries

A Site is not itself where your data lives — it’s the pool of people who are allowed to claim to be from your company. The actual data boundary is one level below: the Organization. A Site can contain more than one Organization — think of the Site as the corporate group and each Organization as one plant or child company within it — and belonging to a Site never grants access to any Organization’s data on its own.

Access to a specific Organization’s data is controlled by your Membership status there, and only one status actually unlocks anything: Active. Being on the right Site just means you’re eligible to request that; it doesn’t hand you anything by itself.

Why the first person becomes the owner, and everyone else has to ask

Somebody has to be trusted first — there’s no third party available at sign-up to vouch for who legitimately represents a company. Tooling Metrics resolves that with a simple rule: whoever confirms the first account on a domain becomes that domain’s Organization owner automatically, with full access and no membership approval needed.

Every account confirmed on that domain afterward is a stranger from the system’s point of view — someone who merely typed an email at the same domain, not someone the owner has vetted. So instead of granting access, Tooling Metrics creates their Membership as Requested and stops there. They can see nothing until the owner reviews the request and approves it, at which point — and only then — their Membership flips to Active. Reject or ignore it, and they simply never gain access; there’s no separate revocation step needed for a request that was never approved.

This is also why the request screen shows up again if your access is later Suspended — from the system’s perspective, a suspended user and a not-yet-approved user are in the same position: on the right Site, but without an active Membership, so without access to any Organization’s data.

What the first sign-up actually protects against

The isolation above rests on one fact: confirming a mailbox at a domain proves you can receive mail there. That is what keeps genuine outsiders out — someone with no mailbox at acme.com cannot confirm an account, and therefore cannot claim ownership of the domain. It does not prove you’re authorized to represent the company. The model quietly equates “controls a mailbox at the domain” with “may own the company’s org,” so the first sign-up is, in effect, a credential: whoever confirms the first acme.com mailbox becomes owner of everyone’s data.

That’s the real shape of the risk. It isn’t a stranger on the internet — they’re blocked by confirmation. It’s a single mailbox at your own domain that is compromised, phished, or rogue, or a catch-all address the attacker can read. One bad first sign-up, and the attacker owns the org and can approve their own confederates. Treat that first sign-up like a credential, and expect to recover ownership through support rather than assuming the first claimant is always legitimate. (This is also why products that call this domain capture require verifying the domain at the DNS level first — a TXT record proves the org controls the domain independent of any one mailbox, so a rogue inbox can’t crown itself owner.)

Why free email providers are rejected at sign-up

The whole design rests on a domain meaning one company. That assumption breaks completely for a shared provider like gmail.com or yahoo.com — millions of unrelated people use addresses on that domain, so treating it as a Site would mean the first random person to sign up with a Gmail address becomes “the owner” of every other Gmail user who ever signs up afterward, with the power to approve or ignore their access requests. That’s not a trust boundary at all.

So Tooling Metrics rejects sign-up with a known free consumer email domain outright, with a message asking for a company email address instead. This is a separate check from the disposable-email blocklist, which exists for the more familiar reason of blocking throwaway addresses used to abuse free trials or bypass confirmation — free providers are rejected because of what they’d do to the ownership model, not because they’re disposable.

One thing this check does not do: it doesn’t stop domain squatting. Squatting isn’t an attack that arrives via a free provider — it’s what happens when a legitimate-looking corporate mailbox at acme.com is the one that’s compromised or catch-all. The free-email block is still correct, because domain capture only makes sense for a domain a single company actually controls; it just isn’t the control that keeps a rogue insider out. That job falls to email confirmation and to protecting that first sign-up, covered above.

What this means in practice

• If you’re the first person from your company to sign up, you get full access immediately after logging in — see Log in and get access.
• If someone else got there first, you’ll need their approval — the same tutorial covers what that looks like from your side, and Approve an Access Request covers approving requests from the owner’s side.
• If your sign-up is rejected for using a free email provider, use your work email instead — there’s no override, because allowing one would undermine the isolation every Organization on the platform relies on.

Related articles

• Create your account
• Log in and get access
• Reset your password