Fine-grained access lets the team breathe

In agencies and holdings the leak story starts like this: on setup day someone says “admins should see everything or work will stall.” Three months later an intern opens a client folder, sees a rival brand’s brief, or a finance file lands in a public Slack. Nobody stole anything. The role is too wide. “Admin” is no longer a person — it is a habit: every stuck workflow opens a grant, and nothing is ever closed.

Blunt access looks fast at first. A support ticket closes with “just make me admin.” Then nobody has a map: who sees this folder, who may move this list, who may export this report. On audit day an Excel matrix appears; it does not match reality because panel grants have drifted for six months. In Ontra the answer lives on the record. “Who can see this folder?” is read from project and list grants. A quarterly export prints that live truth.

The first layer is the role. The role says what a person may do in the system: write tasks, delete, create docs, invite, read reports, manage API keys, change tenant settings. Ontra’s permission catalog splits this — keys such as `tasks.read`, `tasks.create`, `docs.update`, `roles.manage`. “Admin” is not a magic box; it is a permission list. Do not default to delete and invite if you do not need them.

The second layer is the resource: which project, which folder. The same “editor” role can sit on two projects with different grants. A designer sees brand A and does not see brand B. The third layer is the list. Someone who sees the sprint list does not have to see the archive queue. With `tasks.assigned_only`, a member only sees cards assigned to them. A field technician does not browse the whole project; the office plan does not force a milestone onto the field.

Piling all three layers into one “admin” shortens setup and kills audit. The opposite — inventing a role per card — also bloats. Five roles are enough: owner/admin, project lead, member, viewer, external guest. Fine-tuning happens on the resource grant, not in role inflation. When a role changes, the panel applies it without a session refresh. “Admin in the morning, viewer at noon” shows up in the log.

Fixing it later gets forgotten. Invite links last seven days; the role is set then. Ontra’s invite form requires a role. “Admin for now, we’ll fix it later” still produces an admin six months on. A viewer is still a seat; there is no secret free account. When an internship ends you close the seat and the price drops that month — but if you do not close it, the grant stays too.

An external guest does not need a workspace invite. Showing a draft is a passworded doc link; the door closes when it expires. A client lead can be a viewer, does not download the file, does not export. In many tools a “viewer” still comments or exports. In Ontra create, delete, and external share stay hidden. Do not let the label contradict the grant.

Access debates are often lost on buttons. If “new task” is on screen, someone will press it. Ontra hides create and delete for viewers; external share stays closed. A client sees the draft and does not download the brief to another studio. That is not distrust — it is a contract boundary. Rival brands can sit in the same agency workspace; a designer only sees the assigned brand.

A manager report sees totals, not the file tree. A holding asks “this client’s effort” without switching accounts; a member does not fall into the wrong client folder. The company record splits projects and keeps login one. Opening a second workspace is invite chaos: three passwords, reports that never roll up, admins that never close.

Each quarter ask three questions: who sees this folder, is this role still needed, does this seat still belong to a person? The answer is read from Ontra grants. You do not maintain an Excel matrix; the record is the grant. Unused invites, intern seats left open, and “test admin” accounts drop in this pass. Security is not a separate product — it is maintenance of the access record.

API keys are an extension of the same discipline. A full-privilege secret leak drops the workspace. Keep scope narrow, copy the value once, revoke unused keys. If an external scheduler only writes tasks, do not grant delete and member invite. CI needs its own named key. A key left as “test” will be running in production six months later.

Ontra permissions are grouped: tasks, projects, docs, goals, forms, reports, team, admin. `tasks.read` is see, `tasks.create` is write, `tasks.status` is move, `tasks.delete` is delete, `tasks.assigned_only` is only own cards. Do not give a field technician delete and every project. A client lead needs `docs.read`, not `docs.delete`. An intern is never given `users.write`.

There are write shortcuts: `tasks.write` opens create+update+status. Do not treat that as “give everything.” Delete is separate. `scope.all` lifts the assignment boundary; it is meant for a holding admin, not a member. `reports.read` opens the report, not the spec tree. Split management totals from the content tree. That split is the base of agency privacy.

When a role changes, the panel applies it immediately. “Could see the project in the morning, cannot at noon” is in the log. Do not wait for a session refresh. In the quarterly pass test every role with this sentence: is this grant required for this job? If not, drop it. Accumulated grants are accumulated leak surface. Five roles are enough: owner, project lead, member, viewer, external guest.

Brand A and brand B sit in the same studio. The designer is assigned only to A. The grant is project A + folder A. B’s brief does not appear in the list, search, or as a map pin. A manager sees effort totals and does not see B’s spec title. The intern is a viewer; there is no create button, external share is closed. Opening admin “just so they can look” destroys this model overnight.

During pitch there is no workspace invite. Passworded link, timer, revoke. On a win the project opens and the grant is written. On a loss the link drops; the archive does not leak to the other brand. This door is the opposite of the Drive “anyone with the link” habit and is the technical counterpart of the agency contract.

Not an Excel matrix — the live grant list. Folder, role, seat, external link, API key. Four questions: who sees it, still needed, does the seat belong to a person, is the link still open? The answer lives on the record. “Test admin” and intern seats left open drop in this pass. Security is not a separate product; it is maintenance of the access record. An unreviewed grant is an open door.

Morning: an intern is invited. The form requires a role: viewer. There is no admin shortcut. A grant is written for brand A’s folder, not brand B. Afternoon the intern cannot find B’s brief in search, sees no pin on the map, sees no create button. Opening admin “just so they can look” destroys this day in one move. Evening the log holds invite, role, and grant. Audit day does not need Excel.

Noon: client A wants a draft. No workspace invite is opened. A passworded link is minted for two days; the door closes when time is up. The client is a viewer and does not download the brief to studio C. The designer only sees A. The manager opens effort totals and does not see B’s spec title. These three views are one panel, not three workspaces. Seats belong to the workspace; you do not buy a separate seat for A.

Afternoon: someone says “I cannot see the project.” The fix is not opening admin. The grant is missing or `tasks.assigned_only` is tighter than expected. When a role changes the panel applies it immediately. “Could see it in the morning, cannot at noon” is in the log. Evening note for the quarterly pass: who sees this folder, does this seat belong to a person, is this external link open, is this test admin still there? Four questions replace a security product. An unreviewed grant is an open door.

Do not memorize the catalog; pick by job. Field: read + status + assigned_only. Editor: create/update, no delete. Client: docs.read, share closed. Project lead: project write, invite, reports. Owner: roles and API. `scope.all` is for a holding admin, not a member. `reports.read` does not open the spec tree. A write shortcut does not open delete. These sentences slow setup and cut the leak. Fast is “admin for everyone”; expensive is the same sentence.

In many tools a “viewer” still comments or exports. In Ontra create and delete stay hidden; external share stays closed. A client lead sees the draft and does not download the file.

When a role changes, the panel applies it without a session refresh. “Admin in the morning, viewer at noon” shows up in the log; you do not need another tool for a midnight leak.

“Who can see this folder?” is answered from project and list grants in Ontra. Do not maintain an Excel matrix; the record is the grant. A quarterly audit export prints that live truth.