Skip to main content

People and access

Use named human accounts for everyday work. Reserve the installation Owner token for recovery.

Manage household members in the browser​

An Administrator opens Settings → People and access to see active and suspended household members. From there an authorized Administrator can:

  • create a local username/password account when local password sign-in is enabled;
  • create a short-lived, one-use invitation when passkey or external sign-in is enabled;
  • review and revoke pending invitations without re-exposing their secret links;
  • edit a member's display name and local username;
  • add or remove direct roles that the Administrator is allowed to delegate while seeing group-inherited roles as read-only; and
  • suspend or reactivate a member without deleting their history.

Copy an invitation link immediately and send it through a private channel. Its bearer is returned only once, is carried in the link fragment rather than an HTTP query, and cannot be recovered after the view is refreshed. A suspended member's sessions and personal access tokens stop authorizing new work.

Share Join your household's Jiandu with new members. Agree on a non-sensitive sample they can find and download, then verify they can sign in again through the ordinary household address without reusing the invitation.

The native API remains necessary for custom-role and group administration, personal access tokens, and document grants. Jiandu does not expose cross-member password reset to Administrators; only Owner recovery can perform an impersonation-capable credential reset. Changing a local username does not change the member's password or invalidate current sessions.

Built-in responsibilities​

  • A Member uses the normal document workflow.
  • An Administrator manages the installation and household configuration but does not implicitly see every restricted document.
  • The installation Owner retains a durable recovery grant.

Groups and custom permission sets can model recurring needs without granting every person broad administration rights.

Restrict exceptional documents​

The household library is shared by default. A document manager can restrict a sensitive document to named people or groups and grant Viewer, Editor, or Manager access. Use restrictions for exceptions rather than building a maze of one-off rules.

After changing access, verify with a real test account. An administrator view alone cannot prove what a Member sees.

Sessions and tokens​

Revoke sessions when a device is lost or an account changes hands. Personal access tokens should be scoped, expire, and belong to a named integration. Their raw value is shown only when created, so place it directly into the integration's secret store.

Review periodically:

  • inactive human accounts;
  • administrators who no longer need the role;
  • unused or unnecessarily long-lived personal access tokens;
  • external identities linked to each account;
  • restricted documents whose access list no longer matches reality.
Last updated on