How access works

Every question of the form “may this person do this to this board?” is answered by one rule, in one place on the server. The board list, the board itself, the folder tree and the “who has access” panel all ask it, so they never disagree.

Paths in

A person reaches a board through any of these paths:

1. Owning the personal space it is in — everything.
2. Being an owner or admin of its organization — everything, everywhere, restricted or not.
3. Being a member of its organization — edit (plus share if the organization lets members share), where nothing is restricted.
4. Being a viewer of its organization — view, where nothing is restricted.
5. A grant — to the person, to a team they are on, or to everyone in the organization — on the board or on any folder above it.

What a person may do is the union of every path they hold. A team viewer who is an organization member still edits where the organization reaches.

Inheritance

Paths inherit down: a grant on a folder reaches every folder and board inside it.

Restriction cuts

A restricted folder or board cuts every inherited path at that point — except owners and admins. Below the cut, only grants made at or under it count. See restricted folders.

What never counts

• An expired grant. Grants with an end date are removed within a minute of it.
• A grant to a team or everyone for someone who is a team or organization viewer — it is capped at view for them.
• The board’s creator, as such. Who created a board grants nothing; where it lives does.

The organization’s policy comes first

An organization can require more of a session than of a person — a second factor, single sign-on, an allowed address range. A session that does not meet it is refused every path into that organization, owners’ and admins’ included, with a sentence saying what is required. Their own space and every other organization are untouched. See security policy.

Refusals

Every refusal is the same 403. A board you may not open looks exactly like one that does not exist, so ids cannot be probed. When you would have had access but the organization’s policy blocks the session, the refusal says so and names the requirement.

Who has access, and why

Every board and folder has an access panel listing each person who can open it, with their permissions and each path — owner, admin, organization, team on folder X, direct, link, everyone — plus addresses that have been invited but have no account yet. It is computed with the same rule. Somebody who may share sees everybody; anyone else sees their own entry.