How 1CloudHub actually works.

One frame per team. Sections declared by the frame rather than fixed in code. And every claim carrying the evidence that earns it — measured, policy, derived, or openly undecided.

Staff only

Atlas has no accounts of its own. Use the Microsoft 365 account you already have — a request that is not signed in never reaches a page, which is the whole of what makes this site internal.

Continue with Microsoft 365

There is no public page behind this one. Not a marketing choice — every unauthenticated request redirects here.

Tenant: 1cloudhub.com, pinned. A token from any other tenant is refused.
Guests: B2B guests are refused. Someone invited to a SharePoint document is not staff, and reading here cannot be narrowed once you are in.
Session: Identity only. Never your role, never your ownership, never a refresh token — those are joined from the database on every request, so a revocation takes effect now rather than at your next sign-in.

Once you are through the door you can read everything. Writing is where it narrows — and that is the one place Atlas checks twice.

A team that has not declared a frame says so on the Coverage ledger, by name. A blank frame and a missing frame look identical to a reader, and only one of them is a finding.