Status. Proposed design only. Nothing in this vault is DG client approval. No application, service or test has been executed; every scenario is Not executed. Fees and dates are open.
Permissions and confidentiality
Source: architecture rev 3 p. 5; proposal pp. 3, 6.
Access combines active membership, role, assignment, ownership and, for private engagements, participation.
| Role | Allowed within authorised company scope | Restricted |
|---|---|---|
| Owner / company admin | Manage team; publish/respond; approve; assign work; access company business records | Cannot access unrelated companies’ private engagements; company-admin access is disclosed to participants |
| Approver | Review/publish drafts; approve formal interest; accept or decline discussion requests | No platform membership administration; no unrelated private records |
| Contributor | Prepare assigned drafts and interest; communicate in assigned permitted conversations | Cannot publish or formally submit unapproved interest |
| Viewer | Read records permitted by company policy and assignment | Cannot send messages, publish, mutate or change the team |
| DG administrator | Approve/revoke membership; see scoped operational metadata | No message content by default; explicit authorised support access is audited |
Counterparties share only their authorised engagement. A–B and A–C stay separate: B cannot access A–C; C cannot access A–B. Company A’s admins can read A’s records, and A discloses that to participants.
Rules:
- Resolve membership and record access on the server for every read, mutation, search, count, export and job.
- Recheck access when a message is queued, before delivery and when a link is opened; an email link is not an access grant.
- Denials must not reveal whether an inaccessible record exists (T27).
- Revocation blocks future access, not copies already legitimately seen (T25).
- DG metadata candidate: opaque record IDs, approved state/event labels and timestamps; no bodies, terms, decline reasons or contact data. Company/participant identifiers await Q08. See T28, DG22.
- UI wording at publication and before the first private send: Acceptance opens a discussion. It is not a confidentiality agreement. Sensitive documents belong outside this product.