There's a quiet failure mode in collaborative software: permissions that hide things in the interface but don't actually protect them.
The document disappears from the sidebar, so everyone assumes it's private. Then someone pastes a direct link into chat, and it opens. The hiding was cosmetic. The authorization was never real.
We recently reworked access control in Andika, and the guiding rule was simple: access has to be enforced everywhere the data can be reached, not just where it's displayed.
Default open, precisely closed
The collaboration model starts permissive on purpose. When you invite someone to a workspace, they can see and work in it. That's what makes sharing low-friction.
The control comes from exceptions. Workspace owners and administrators can restrict individual notebooks, documents, and attached files, so sensitive research, contracts, or internal drafts stay protected without forcing you to create a whole separate workspace every time something confidential comes up.
This "default open, precisely closed" shape matters. If privacy requires restructuring your entire workspace hierarchy, people won't use it, and the sensitive material ends up in the shared space anyway.
Enforcement means every surface
The part that does the actual work is unglamorous: every way a piece of content can be reached has to check the same rule. When someone is excluded from a document in Andika, that means it's gone from:
- navigation and search results
- knowledge maps and analytics
- notifications and mentions
- direct links (the important one)
- revision history and discussions
- AI-assisted features that read workspace content
- attachments and live collaboration sessions
That last category is easy to forget and dangerous to forget. An AI feature that cheerfully summarizes a document the requester can't read is an authorization bypass with good branding. Any feature that retrieves context on a user's behalf, whether it's search, an LLM integration, or an export, has to evaluate the same permissions as the page view.
Revocation has to be just as thorough. If access is withdrawn while someone is mid-edit in a live collaboration session, the session closes immediately. A permission change that only takes effect "next login" is a permission change that didn't happen.
The takeaway
If you build or buy collaborative software, the test isn't "does the hidden thing disappear from the menu?" It's "enumerate every path to the data and check the lock on each one." Links, APIs, exports, search indexes, AI retrieval, live sessions. The count of paths is always bigger than you first think.
Privacy that lives only in the UI is a vibe. Privacy that lives in the data layer is a property.
This post was adapted, with AI assistance, from an article on the Andika blog, where we build a collaborative writing and knowledge platform.
Top comments (0)