Attunement Administration & Access Control

This manual governs access privileges, institutional list partitioning, and inbound routing for Foundation administrators, board trustees, and IT officers.

---

1. Institutional List Architecture & Access Boundaries

ToFF Attunement implements strict workspace segregation between public operational intelligence and executive board governance:

Workspace List	Access Eligibility	Content Scope	Security Classification
Social Media & Public Updates	Communications staff, media managers (including Allen), curators	Public press clippings, exhibition reactions, social media trends	Internal Operational
Board Members Only	Foundation Trustees & Executive Leadership	Legal correspondence, donor dialogues, board memos, strategic filings	Confidential Executive

Strict Isolation Policy

Non-board staff accounts cannot view the Board Members Only list or any items indexed within it. All sensitive institutional inquiries and board communications must be explicitly routed or filed to this repository.

---

2. Institutional Feature: Forward-to-Keep Email Ingress Gateway

Staff & Board Ingress Protocol

Automated Board Briefing

To eliminate manual copying, downloading, and fragmented correspondence across personal devices, ToFF Attunement provides Forward-to-Keep—an institutional email gateway designed for frictionless archival intake and board briefings directly from any desktop or mobile email client (Gmail, Apple Mail, Outlook).

Gateway Address:

keep@tomoffinland.org

Ingress Architecture:

1. Universal Ingress Authorization: All Foundation staff members, coordinators, curators, and trustees are authorized to forward records to keep@tomoffinland.org.
2. Automated Board Routing: All forwarded emails are ingested and partitioned directly into the Board Members Only workspace, completely invisible to non-board staff.
3. Autonomous Ingestion Worker: The system polls incoming correspondence continuously, processing new records within 30 to 60 seconds:
   • Articles and Press Links: The backend autonomously dispatches a headless browser worker to capture a full-page high-definition screenshot, generate an archival PDF, extract complete article text, and synthesize AI metadata.
   • Correspondence, Inquiries & Memos: Sender identity, date stamps, subject headers, and thread bodies are converted into immutable searchable cards.

---

3. User Account Provisioning & Whitelisting

• Centralized Provisioning: User accounts are created and configured exclusively by the Foundation Systems Administrator. Self-registration is permanently disabled.
• Email Whitelisting for Forward-to-Keep:
  • Personnel must forward emails from their official @tomoffinland.org institutional address.
  • If a trustee requires authorization to forward from a personal address (such as personal Gmail), Administrator Nolan must register the address on the institutional whitelist.
• Credential Rotation: Passwords must adhere to Foundation cryptographic standards and be rotated following personnel transitions.