Who may open a product

Context and Problem Statement

Teams were drawn as groups of members that a product is shared with, but nothing said what sharing does. Until now every member of a company could open every product.

Considered Options

• Shared means restricted: a product shared with no team is open to everyone; once shared, only its teams and the owner.
• Always by team: a product is open only to teams it is shared with.
• Teams are labels only.

Decision Outcome

Shared means restricted, chosen by the owner on 2026-10-13. Nothing changes for a company that never makes a team, and a company that does gets real separation.

• A product shared with no team is open to everyone in the company.
• A product shared with one or more teams is open to the members of those teams and to the owner.
• Only the owner makes, renames and deletes teams, changes who is in them, and shares products with them.
• A person's access level is unchanged by this. It says what they may do in a product they can open.

Consequences

• The rule is kept in the database, as row-level security on the product and on every table that belongs to a product. The web app says who is asking with withMember; a query cannot forget the rule. See tenant-isolation.
• The capture worker has no person and sees every product of the company it is working for.
• Deleting a team can open a product that was shared only with it.
• A preview link is read by its secret before any company is known, so reading one is not narrowed by this rule. Making one is.