Admin: Access & sharing

Everything DraftMesh shares is shared one document at a time. There is no “share this folder” and no “share this workspace” — a grant names a workspace, a document path, and one person or agent. That keeps the blast radius of any single mistake to a single file.

The four capability levels

Capabilities are a straight ladder. Each one includes everything below it:

Because it is a ladder and not a grid, “at least suggest” is a single comparison everywhere in the product. There is no capability that lets someone change a document without either edit or a human accepting their suggestion.

Sharing is an admin-only act. Holding edit on a document never lets you pass it on — a grantee cannot re-share, cannot invite anyone, and cannot widen their own level.

What a share does beyond the one document

Granting a person a document also makes them a derived member of its workspace, so they can find it. That workspace appears in their workspace list with a Shared badge, and they can read its other documents at view.

Writing is not derived. To comment, suggest, or edit anything, they need a grant on that exact document — a view-level read of a sibling never becomes a way in. Agents and task credentials get none of this: their access stays pinned to the one document they were granted.

Guest links

A guest link lets someone read or respond to one document without a DraftMesh account. They open the URL and they are in, as a named-but-unverified guest.

Because a link is a bearer token — anyone holding it is the audience — it is deliberately bounded:

• Capped below edit. A guest link can carry view, comment, or suggest. Never edit. A tokenless holder cannot write document text.
• Always expiring. Expiry is mandatory, not optional. Expires offers 1 hour, 24 hours, 7 days (the default) and 30 days. There is no permanent link.
• Optionally section-scoped. A link can expose the whole document or just one section of it. The server enforces that on every guest read and write — the boundary is not drawn in the browser.
• Revocable at any time, which takes effect immediately.

What the recipient of a guest link sees

Worth knowing before you send one, because the guest page is a surface of its own and not the app you are looking at.

They get the document (or just the section you scoped the link to) rendered as prose, with the comments already on it, under a banner reading “You’re viewing a shared section as a guest”. There is no sign-in prompt, no file list, no history, and no way to reach a second document.

Below view, they can select a passage and Comment on selection, then give Your name and Your comment and choose Send comment. They are named-but-unverified: the name is whatever they type.

One thing to set expectations on: a guest never gets a suggestion box, even on a link issued at suggest. A suggest-level link behaves as a comment link, and the page tells them so — “You can read this section and leave comments.” A view link says “Commenting is off for this link.”

When a link is finished, the page says which kind of finished it is: “This link has expired.”, “This link has been revoked.”, or “This link is no longer available.” — with a line telling them to come back to you for a new one.

The Access review section

⚙ Settings → Administration… → Access review is the one place that answers “what has this organization shared?” without opening documents one at a time.

It has two tabs:

• Shares — every grant in every workspace: the workspace, the document, who holds it (a person or a registered agent), at what level, and who granted it. A grant held by a revoked agent is shown, marked as inert, rather than hidden — so you can clean it up.
• Guest links — every link ever issued: its document, level, scope, expiry, and status. Expired and revoked links stay listed, visibly marked. A governance list that quietly drops rows is a list you cannot trust, and a link you just revoked should read as Revoked, not vanish.

Each row has a Revoke with an inline confirmation. Revoking here does exactly what revoking from the document’s own Share panel does — it is the same operation, not a second one.

Export CSV downloads the current tab. The guest-link export deliberately contains no link tokens: a spreadsheet sitting in a downloads folder is a bad home for live document credentials. Use it for access reviews and security questionnaires, not for re-sending links.

Things to know before you rely on this

These are real limits today, not oversights being hidden:

• No groups. You grant to individual people and agents. There is no “Engineering can comment”. The Admin / Member roles govern the Administration console, not who can reach which document — a member and an admin are granted documents the same way.
• No workspace-level or folder-level grants. Every grant is one document.
• Sharing a document notifies nobody. Creating a grant or a guest link sends no email — you have to send the person the link yourself. (Inviting somebody into the organization is the one thing that does mail them; see Admin: Your organization.) A grant addressed to an email address simply waits until that person signs in.
• Members cannot share their own documents. Sharing is admin-only, so every grant and every guest link has to go through an admin.
• Revoking access does not end an existing sign-in session. The grant stops working immediately; there is no session-listing or session-revocation screen yet.