Who can see what, decided once.

The screen

Teams

The directory, the roles, the reviews.

What you get

Everything below ships today.

• The workspace ladderEvery person holds one workspace level: Company Admin, then C-Level, VP, Director, Manager, Team Lead, HR, Employee or Agent. The level decides the settings pages and the people data; it never decides one object at a time.
• Additive grantsA Space, a Folder, a List, a Board or a Doc can be shared directly. A grant adds reach and never takes it away, so sharing a folder does not require handing over the Space around it.
• Member can writeContributing and managing are separate. A member of a Space or a List can create and edit the work in it without being able to rename, move or delete the container.
• Security activity logSign-ins, password changes, sign-out-everywhere and the sessions holding your account, on your own account page. An org-wide audit view sits behind the manager gate.
• Sign-in hardeningBrute force lockout, hashed reset tokens, a password policy, idle session expiry, a real sign-out that invalidates the token, and two step verification at login.
• What we do not claimNo certification, no SSO or directory provisioning, and no choice of storage region. When any of those ship they will be named on the security page with their evidence, and not before.

How a permission is actually decided.

1. Start from the person's workspace level
2. Add every grant they hold on the object, and on the containers above it
3. Take the strongest of those, because a grant only ever adds
4. Assigning someone a task grants them the task, so work is never invisible to the person doing it

It reads the rest.

• PeopleOrg chart, roles and history.
• SOPsProcess docs with acknowledgement.

Questions

Straight answers.

Open it on your own work.