Access & people — the full permission model

Permissions have two independent layers. Once you see the split, every "who can do/see what" question has a clear answer.

Signing in

Everyone signs in with their work email and a one-time code — no passwords, nothing to install. You control who's on the list.

Layer 1 — Roles (what you can do)

• Viewer — read documents.
• Editor — create, edit, and share documents, and organize rooms.
• Admin — everything an editor can do, plus manage people and access for the whole company.

A role can be set company-wide (applies everywhere) or for a single room. A room-specific role overrides the company role for that room only — so the most specific role wins.

Common setups

• Edit access to just one room: add the person as an editor on that room and give them no company-wide role. They can work in that room and nothing else.
• Company member, read-only in one room: they're a company editor, but you add a room role of viewer on the sensitive room — so they can edit everywhere except there, where they can only read.
• Company-wide reader: make them a company viewer — they can read every room but change nothing.
• Runs everything: company admin.

Layer 2 — Room access (what you can see)

New rooms are private by default — only the person who created it can open it, until people are added. Nobody is auto-added. Each room can be:

• Private (default) — only the people you add can open it. (One click adds everyone in the company.)
• Everyone in the company — any company member can open it.
• Public — anyone with the link, no sign-in.

The examples you asked about

• "Someone who can read only in certain rooms": give them a company viewer role (read-only everywhere), or a viewer role on just those rooms with no company role (read-only, and only those rooms).
• "Someone who can't see certain rooms at all": rooms are private by default, so just don't add them to that room (or, if it's been opened company-wide, make it private again and add only the right people). They stay a full member elsewhere.

Working in the same room together

Give as many people the editor role as you like — they can all work in the same room at the same time, with no checking out or locking. If two people happen to edit the same document at once, the system catches it and makes sure no one's work is overwritten. See Working together on the same document for how that looks and a few tips.

Doing it in the web app

Admins get a People & access tab (top of the app):

• Default reader access — list your company's email domain (e.g. acme.com) so everyone at the company can read by default, and/or specific always-allowed emails. Leave it empty for strictly invite-only.
• People & roles — the full on-screen list of everyone with a role (and their room-specific roles shown as chips); change roles, remove, or invite.

Inside any room, admins get a Who’s in this room section: rooms start private (only you), and you add people one at a time, click Add everyone in the company, or switch the room to company-wide / public. Or just ask Claude using the phrases above.