Collections & permissions

A person gets answers only from documents they could open in the source system, and that is checked on every request. Documents are grouped into collections, connected documents carry their source permissions mapped to individual Colrows users, and group or public sharing never widens access. This governance is separate from the access and masking policies that apply to SQL.

Collections

• A collection is a set of documents you select and ask questions over. A connection targets one collection; uploads go into a private collection.
• Each collection has explicit readers and managers. Being a member of the organization, or even an administrator, does not grant read access on its own - access is granted on the collection.
• Creating collections, mapping permissions, retention, and deletion are administrator or curator actions.

Source permissions

For a connected document, reading it also requires a source permission that maps to a specific Colrows user. Colrows reads these from the source and maps them:

• Group, public, and domain sharing grant nothing. Only an individual-user mapping grants access.
• Fail closed. A document whose permissions cannot be read is treated as visible to administrators only.
• Permission age. Permissions are refreshed on every sync; if they go stale beyond the allowed age, the document becomes unavailable until the next successful scan.

Handling and retention

• Connector credentials are held in your secret manager and are never returned to the browser or written into request traces.
• Every read and every answer is scoped by organization, including the filter on the document index, so one tenant's documents never reach another.
• Answer responses are returned with Cache-Control: no-store, and source content is not kept in browser storage.
• Documents support a retention window and legal hold; deletion propagates to the search index and removes the document from answers.