Permissions & settings
Permissions
Documents access is controlled by a small set of permissions, layered with folder access and sensitivity level:
| Permission | Grants |
|---|---|
documents:read | Browse folders, open files, view versions and links, at Public/Internal sensitivity |
documents:write | Upload files, create folders, upload new versions, edit tags/category, create share links |
documents:confidential | See and open files marked Confidential, in addition to Public/Internal |
documents:restricted | See and open files marked Restricted — the highest sensitivity tier |
documents:manage | Manage folder permissions, configure app-folder defaults, and access /documents/settings |
⚠️
Permissions are additive with folder access — having documents:confidential doesn’t bypass folder-level “Manage Access” rules, and having folder access doesn’t bypass sensitivity. Both checks must pass for a file to be visible.
Related settings
| To change | Go to |
|---|---|
| Folder policy, retention, default sensitivity | /documents/settings |
| Who can see confidential and restricted material | Settings → Roles (documents:confidential, documents:restricted) |
| Data scope for documents | Settings → Roles → Data scope |
| Which app folder a record type attaches into | Configured in code — ask a developer; it is deliberately not a per-tenant setting |