Sharing & Permissions
How access works for Docs, projects, and team members in Definite
Access in Definite is determined by three layers, evaluated together:
- Team role (Admin or Analyst): set on the team member directly.
- Project membership: who has been added to a project, plus an optional "Everyone on team" toggle.
- Doc sharing: per-Doc grants (View, Edit, Admin) and the public link toggle.
Admins on a team can see every Doc in the workspace, regardless of project membership or per-Doc sharing.
Sharing a Doc
Open a Doc, click the ⋯ menu in the top toolbar, and choose Share.
You can:
- Add specific teammates by email, with a permission of
View,Edit, orAdmin. - Generate a public link by enabling the public toggle. Anyone with the link can view the Doc; no Definite account required. Use with care for sensitive data.
- Remove access at any time. Changes apply immediately.
Permission levels for a Doc:
| Level | Can do |
|---|---|
| View | See the Doc and its data; cannot edit tiles, queries, or layout |
| Edit | Everything in View, plus edit tiles, queries, layout, filters |
| Admin | Everything in Edit, plus manage who else has access to the Doc |
Sharing a project
Projects are folders for related Docs and Fi threads. Sharing a project cascades access to every Doc inside it, so you can grant a group access to a set of dashboards in one action instead of sharing each Doc individually.
Open a project, click Share in the header, and choose one of two modes:
- Share with specific teammates: pick people from your team and set their permission (
Can vieworCan edit). They get access to the project and every Doc in it. - Everyone on team: a single toggle that grants the whole team
View(orEdit) access to the project and its Docs.
Adding or removing project members updates Doc access immediately. Moving a Doc out of a shared project removes the cascaded access (the Doc reverts to its own per-Doc sharing).
Project sharing only grants access to Docs inside the project. It does not grant any new permissions on the underlying data sources or models. A teammate who can view a Doc cannot necessarily query the same tables in a fresh Doc.
Admin override
Team members with the Admin role can see every Doc in the workspace, including private Docs and Docs in projects they are not a member of. This is intentional. Admins are the team's owners and need to be able to audit, recover, and manage all content.
If you need a teammate to be restricted from private Docs, demote them to Analyst. See Roles for how.
The same applies to Definite staff with admin access to your team for support purposes; we never view team data without your request.
Permission matrix
How visibility resolves for a single Doc, depending on the viewer's role and how the Doc is shared:
| Viewer is... | Doc shared directly with them | In a project shared with them | Project has "Everyone on team" | Doc has public link | None of the above |
|---|---|---|---|---|---|
| Admin on the team | ✓ | ✓ | ✓ | ✓ | ✓ (admin override) |
| Analyst on the team | ✓ | ✓ | ✓ | ✓ | ✗ |
| Not on the team, has public link | ✗ | ✗ | ✗ | ✓ (read-only) | ✗ |
| Not on the team, no link | ✗ | ✗ | ✗ | ✗ | ✗ |
Embedded users
For dashboards embedded in your own application via Embed, Definite issues a signed token that scopes the viewer to a single Doc (or data app) with optional row-level filters. Embedded viewers do not appear in your team and cannot see anything outside the embedded artifact.