Distribution & compliance

Publishing a policy isn't the end of a compliance process — you still have to hand it to a named audience, track who's read it, and be able to prove it later. That's distribution: a recorded act that says this version went to these people on this date, with each person's acknowledgement tracked against that frozen snapshot. This page picks up where Controlled documents leaves off — you've published; now you roll it out and prove it landed.

Groups — name your audiences once

A group is a named, reusable list of people — all-employees, engineering, uk-staff. You build it once and distribute to it by name. Only admins create and curate groups.

Groups are also the sanctioned way to reach external people — contractors, partners, auditors. A group's membership can include people who aren't on your team, and because only an admin curates the list, distributing to that group is what safely grants those externals read access to the document. (By contrast, if you hand raw individual email addresses straight to a distribution, those addresses must already be company members — an external can't be pulled in that way. This guard keeps an editor from quietly granting outsiders access; externals come in through an admin-curated group or not at all.)

Distribute a published document

Once a controlled document is published, an editor distributes it to one or more groups and/or named individuals. Distribution is deliberate and recorded — it's the moment the obligation attaches to people.

Distributing does four things:

• Snapshots the audience — the exact set of people, frozen against this published version on this date, written as a single atomic record. People who later join or leave the room don't change it. That frozen snapshot is precisely what an auditor asks for.
• Grants access automatically — anyone in the audience who couldn't already open the room is given read access (as a room viewer), so the link works when it arrives. Someone who's already a company admin or editor keeps their higher role — distribution never demotes anyone.
• Notifies everyone — a Slack DM where connected, email otherwise, each carrying the link, the attestation statement, and any deadline. A distribution can also post one summary to a channel. See Notifications.
• Opens acknowledgement tracking — from now on the report shows, per person, whether they've acknowledged and how they entered the audience.

To add people after the fact — a new hire, a late-added reviewer — use add to audience. They're recorded as added later so the record still distinguishes the original distribution from top-ups.

Acknowledgements — the recorded "I've read this"

Everyone in the audience opens the document and sees an Acknowledge bar at the bottom showing the attestation statement you set (for example, "I have read and understood this policy"). Clicking it records their email, a timestamp, and the exact statement text they attested to. Readers see only the document and their own acknowledgement status — never the review/approval workings behind it. Claude tool (for someone acting on their own behalf): acknowledge.

Each person in a distribution is one of these, and the report labels which:

Deadlines & reminders

If you set an acknowledge-by deadline (on the Govern panel), the document is flagged overdue once the date passes with people still outstanding. At any point an editor can remind everyone still outstanding — a fresh Slack DM or email with the link, statement, and due date. Reminders skip anyone who can no longer access the room (a reminder they can't act on is just noise); they stay listed as outstanding in the report. Claude tool: remindAcks.

Self-enroll links — acknowledgement without room access

Sometimes you need someone to read and acknowledge a single published document without giving them the controlled room. A self-enroll link does exactly that. An editor mints a revocable, document-scoped link and posts it wherever suits — an email, an intranet page, a Slack channel.

When someone opens the link, the server checks they're allowed before enrolling them: they must pass your company's own reader rules (for example, be on your company's email domain) or already be a member. The link alone is not enough — a link that leaks to an outsider on a different domain is refused, and nothing is recorded for them. Anyone who does pass becomes a company viewer (never a member of the controlled room) and is added to the document's audience with source link. They then read and acknowledge from a personal My acknowledgements view — they can see that one document, and only the published version of it, never drafts or the room around it.

Self-enroll links are the one audience type that carries forward across a major re-publish (see below): a posted link behaves like a standing "acknowledge every version" subscription, so each enrollee is re-prompted to acknowledge the new version.

Re-publishing: minor vs major

When you publish a new version of a document that's already been distributed, what happens to the existing audience and acknowledgements depends on whether you mark it minor:

My tasks — everything waiting on one person

Everyone gets a personal My tasks view in the web app: documents waiting for their review, their approval, and acknowledgements they owe — with nothing they've already done or can't act on. It works even for reviewers and approvers who aren't otherwise members of a room, because being assigned is what authorizes them. Every review request, approval request, and distribution notification links straight here. Claude tool: myAssignments (and myAcknowledgements for the acknowledgement queue).

The Compliance dashboard (admins)

Admins get a company-wide Compliance view: every controlled document with its lifecycle state, its reviewers and approvers, acknowledgement coverage with overdue flags, and its last distribution — drill into any document for the per-person record. It also hosts an activity feed of recent compliance events and links to group and notification management. It respects room privacy: a private room an admin isn't in doesn't appear. Claude tool: complianceOverview.

Producing evidence for an audit

At any time you can download a per-document acknowledgement report as CSV — the compliance record for that policy. From the Govern panel choose export, or ask Claude. Claude tool: ackReport.

Each row is one person: their email, whether they acknowledged, the timestamp, and their source (how they entered the audience). The summary carries the published version, the document title, the attestation statement in force, the due-by date and whether it's overdue, and the totals — audience size, acknowledged, and outstanding. Because the audience is a frozen snapshot per version, the report answers the auditor's real question: who was asked to read this exact version, and who attested to it, by when.

How this maps to common compliance controls

rooms doesn't certify you against any standard — that's between you and your auditor — but the controlled-documents workflow is built around the evidence these programs typically ask for. A rough map:

Every action, both ways