Sharing and Permissions

Sharing and Permissions

Access is decided in Folio, not in Git: roles per space, narrower rights per page, and links for people outside. The instance administrator manages people and access but does not read spaces they are not a member of.

Roles

Role	Can
Viewer	Read (Reading mode only)
Editor	Read and edit pages, tables, boards and forms
Admin	Edit, plus manage the space's access, settings, keys and publishing

Roles belong to the space. An instance administrator creates people and invitations; they can grant themselves access to a private space, but that is written to the audit log and marked for everyone to see.

Space visibility

• Private: explicit members only.
• Instance: every signed-in person can read; edit rights still have to be granted.
• Public: also readable by anyone as a website (Publish a Public Website).

The access matrix

People down the side, spaces across the top, a role in every cell. Change one cell or many at once. Every grant, revoke and visibility change goes to the audit log with who and when.

Page access

Any page can be narrower than its space: open to all members, to you only, or to chosen people with view or edit rights. Tree, search, quick switcher, backlinks, graph, bases, artifacts, export, copy, live editing, MCP and the assistant all filter out pages a person cannot open.

A restriction is not inherited by child pages. There is no "close the whole subtree" mode, so lock each page that must stay closed. A file in the repository is hidden from a member only while every page linking to it is closed to them.

Getting people in

1. Invitation link with a preset space and role, an expiry date and a use limit; optionally pinned to an email.
2. Access requests: someone who opens a space they cannot see asks for access; admins are notified and pick the role.
3. Sign in with Google, limited to the email domains you list; a new person gets an account and no access until someone grants it (setup).
4. Deactivate an account without deleting what the person wrote.

Share links

A link to a page for people without an account: view or edit, one page or "with child pages" (pages with their own restrictions, and everything below them, are left out). Add .md to get plain Markdown, handy for external agents. Edits by guests reach Git with matching authorship. Restricting a page later also removes it from existing links. Links are created and revoked only in the browser, never with an API token.

A form can also take answers without an account: it needs both the public flag and a valid share link (Data Tables and Forms).

Agents and tokens

A token or OAuth grant never has more rights than its owner, and read tokens cannot write (Connect AI Agents). .agent is visible to space admins only.

The public demo

The demo uses one shared login, resets daily and turns off tokens, invitations, share links, Git, import and the assistant. Fixed read-only copies of the templates are shared there by link.

Limits

• No user groups, no SSO or SCIM; sign-in is email and password, optionally Google.
• No end-to-end encryption of content.
• Page rights are not inherited (above).
• Someone with edit rights on the Git repository can change files outside Folio's rules; the repository's own access is separate.
• A Chat preview shows a restricted page's title to the whole channel (Slack and Teams Link Previews).

See also

README: access management · Getting Started · LIMITATIONS.md · Folio vs. Confluence