document access

Explicit per-document visibility policies and grants layered after household RBAC

📄️Inspect a document's explicit access policy and grants

Requires documents.share, PAT share when applicable, and a current document-local manager grant for restricted documents. The installation owner retains a non-removable recovery manager path.

📄️Restrict a document or return it to shared-library visibility

Requires documents.share, a current document-local manager grant, a browser same-origin proof for cookie requests, and PAT share when applicable. Restricting creates a durable owner-recovery manager grant and a designated active policy manager grant atomically.

📄️Grant document-local viewer, editor, or manager access

Requires documents.share, a current document-local manager grant, a restricted policy, active direct recipients or a group with an active member, and PAT share when applicable. Grant changes are durably audited.

📄️Revoke one document-local direct or group grant

Requires documents.share, a current document-local manager grant, a same-origin browser proof for cookie requests, and PAT share when applicable. The immutable installation-owner recovery grant is deliberately not revocable.