Security — Permissions

Access is decided at three levels, each able to override the one above it. • Workspace role — viewer, contributor, editor, or admin, setting the default for everything inside. • Table access — per person and per table: full, read and create, read only, or no access at all. "No access" removes the table from view entirely rather than showing a locked door. • Field access — per person and per field: read-only, or hidden. The part that matters: a hidden field stays hidden on every path out of the database. It does not reappear through a lookup or rollup on another table, in a report column or aggregate, in ⌘K search results, or in an AI answer. Permissions are resolved once, server-side, and every one of those surfaces reads the same resolved view. Folder-level access grants or removes a whole group of tables in one action, and a folder someone cannot see is absent rather than greyed out — its name does not appear. Because this is an access rule rather than a copy of the data, relationships across the boundary keep working for the people who are allowed to follow them.