Permissions & Sharing
Who can see, change, or share each folder and file — and how does that stay current?
Every folder and file carries grants with nine separate rights: read, insert, update, delete, copy, move, compress, download, and grant-permission. A grant targets a position in the org chart, an individual employee, a partner, or everyone — and position grants resolve to whoever holds the seat now.
Where the control sits
Outside the organization
Nine rights per grant
Read, insert, update, delete, copy, move, compress, download, and grant-permission — set independently on every grant.
Seats, people, partners, or everyone
Grant targets match how organizations actually share: by role, by exception, externally, or org-wide.
Access follows the seat
Position grants resolve to current holders, so role changes update document access automatically.
Delegated administration
The grant-permission right lets a team govern its own branch without platform-wide authority.
No anonymous links
External sharing happens through partner grants — explicit, rights-scoped, and reviewable.
InsideThe record inside Documents
How it works
The permission model is deliberately fine-grained. Instead of a read/write toggle, each grant sets nine rights independently — a partner might download but never move; a clerk might insert but never delete. The ninth right, grant-permission, delegates administration of a branch to the team that owns it without handing over the whole store.
Grants target the organization’s real structures. A position-in-unit grant follows the seat: whoever holds the position inherits the folder and file rights that go with it, and access ends when they leave it — resolved against current position holders, with no cleanup ticket. Employee grants cover individual exceptions, and access can be reviewed by unit, by position, or by person.
Sharing is a grant, not a link. Partner grants expose files to external partners under exactly the same rights model, and an everyone grant publishes within the organization deliberately. There are no anonymous share links to leak — every exposure is an explicit, inspectable grant.
What this touches
- Identity & access
Document rights are one application of the platform-wide position-based access model. - Organization & positions
Grants resolve against seats and units in the org chart. - System Administration
The same position-and-group model governs application access. - Partner Portal
Partner grants are how documents reach external partners under control.
See permissions & sharing running in continON.
A guided walkthrough on a sanitized demo tenant — this capability inside its module, on the shared platform.