Document access
Documents belong to your organization, the same way tables and datasources do. Every member of the organization, and every agent client granted the documents:read scope, can ask questions over every document Colrows serves for the organization. Administrators and curators manage document sources and documents. This governance is separate from the access and masking policies that apply to SQL.
Who can do what
| Action | Who |
|---|---|
| Ask questions, open a cited passage, and download the cited version of the original | Every member of the organization |
| View connections and ingestion status in Docent → Ingestion Pipelines | Every member of the organization |
| Add, configure, and test connections; run syncs; manage sync automations; retry failed files | Administrators and curators |
| Reprocess, roll back, set retention and legal hold, and delete documents | Administrators and curators |
| Upload knowledge documents in Consensus → Document Upload and read their content | Administrators and curators. Other members see the upload list only. |
Ask questions through the agent interface (askDocuments) | OAuth and MCP clients granted documents:read. See MCP & REST API. |
Any administrator or curator can manage any document connection in the organization, not only the one they created. There are no document collections, readers, or managers: you do not select or grant access to a subset of documents.
Which documents answer questions
A document is used for answers, citations, summaries, and complete queries only while all of these hold:
- It belongs to your organization and has not been deleted.
- It came from a document connection. Knowledge uploads from Consensus → Document Upload feed the semantic layer and never answer questions.
- Its connection is enabled.
- It is not blocked by its source. Sync hides a file whose state at the source it cannot confirm - for example one that was removed, excluded by a filter, or superseded - until a later sync confirms it.
- It has finished processing and is served from the search index.
These conditions are checked on every request, and again before an answer is returned. A document that is deleted, blocked, or whose connection is disabled stops being cited at once; an answer that cites it is not delivered.
Colrows does not read sharing settings or permissions from AWS S3, Google Drive, Microsoft OneDrive, or Microsoft SharePoint to decide who sees a file. Once a connection syncs a file, everyone in the organization can get answers from it, even if it was private at the source. Choose the bucket, prefix, or folder you connect accordingly, and use the connection's file filters to leave files out.
Handling and retention
- Connector credentials are held in your secret manager and are never returned to the browser or written into request traces.
- Every read and every answer is scoped by organization, including the filter on the document index, so one tenant's documents never reach another.
- Answer responses are returned with
Cache-Control: no-store, and source content is not kept in browser storage. - Documents support a retention window and legal hold; deletion propagates to the search index and removes the document from answers.
Document access is organization-wide and decided by the rules above. SQL results are governed by access policies and data masking policies on restricted datasources. Neither applies to document passages.