Description
Per-Dotabase Access Grants let administrators add authority for a specific Dotabase without expanding a principal’s workspace baseline. A grant can attach to a role, affecting every assignee, or directly to a human or agent principal. The evaluator unions the resource grant with workspace permissions only when the protected action targets that Dotabase, and readable-Dotabase resolution pushes the allowed identifier set into list and search queries.
Views, rows, pages, and activity inherit their Dotabase boundary, keeping the model comprehensible and efficient. Administrators manage grants from the Access settings surface, where the available resource-scoped atoms are validated by the same catalog the server enforces. Credential scope narrowing still applies, so a token cannot regain an atom omitted from its issued scope merely because its principal holds a grant.
Selling Points
- Shares selected knowledge areas without turning a narrowly scoped collaborator into a workspace-wide editor.
- Supports role-level grants for repeatable team access and direct grants for exceptional people or agents.
- Filters discovery and search results at query time, preventing unauthorized Dotabases from appearing before an item is opened.
- Uses the same permission vocabulary as workspace roles, reducing the learning burden for administrators.
- Keeps grants additive and inspectable instead of layering hidden exceptions.
User Story
A workspace owner invites an external researcher with a Viewer baseline, then grants update access only to the “Market Research” Dotabase. The researcher can find and edit rows in that resource but cannot browse or change other Dotabases. The owner walks away with a focused collaboration boundary that does not require cloning data into a separate workspace.
Extension Surface
This capability is configurable. Administrators select a target, subject, and supported resource permissions in apps/web/src/modules/access/management/GrantBlock.tsx; packages/access/src/service.ts validates and persists the change. The underlying grant algebra in packages/access/src/evaluate.ts is fixed, so configuration can select known atoms but cannot introduce conditional or negative policy behavior.
Capabilities & Limits
- Grants Dotabase-scoped permissions to either a role or a principal.
- Produces a filtered readable-Dotabase set for collection and search operations.
- Intersects grants with credential scopes when an API or agent credential is used.
- Does not support row, page, or view ACLs; those objects inherit the Dotabase boundary.
- Cannot subtract a permission already provided by a workspace role.
Implementation Map
packages/access/src/evaluate.tspackages/access/src/service.tspackages/db/src/schema/access-grants.tsapps/web/src/modules/access/management/GrantBlock.tsx