Sharing and permissions

Permissions are edges in the same graph as the bullets.

• verified You share a bullet and everything under it, not the documentpersona: linker /help/sharing
• tested A shared bullet is marked visiblyA shared bullet carries a ring on its bullet, and the sheet lists who and what.test/perm.test.js /help/sharing
• verified Permissions cascade to descendantspersona: linker /help/sharing
• verified View permissionpersona: linker, persona: lookonly /help/sharing
• verified Edit permissionpersona: linker /help/sharing
• verified Per-user permissions, changeable at any timepersona: inviter /help/sharing
• verified A secret link that needs no accountA link is a user node with a perm edge, so the visitor is an ordinary principal and may(), the snapshot and the mutation check all apply to them unchanged. Only the hash is stored; the secret is readable once.persona: linker, persona: lookonly /help/sharing
• verified Invite by email; the panel shows invited then acceptedA grant made before there is anybody to grant it to. The intent waits keyed by address and becomes an ordinary perm edge at the first sign-in, which is the only moment anyone can show the address is theirs. Pando does not send the mail: sending on somebody's behalf to a third party is a thing to ask about rather than assume.persona: inviter /help/sharing
• verified Remove an invited user at any timepersona: inviter /help/sharing
• verified A write the sharer is not allowed to make is refused and rolled back in the UI pandoUpstream is silent on failure. Pando's queue axiom makes the refusal observable rather than silent.persona: permissions
• verified Revoking a link closes the tabs already using it pandoBoth halves: the row stops resolving the secret and the permission edge goes, so a session already opened loses access on its next request.persona: linker
• verified A shared branch loads on its own, without the account around it pandoThe snapshot used to be all of an account or none of it, so a grant could be made and never opened. What comes back now is the branch, the person, and what they may do.persona: linker
• verified Revoking an accepted invitation removes the permission too pandoOtherwise revoked would mean nothing to the person still holding the branch.persona: inviter
• verified A bullet can have its own email addressMail sent to it arrives as a child: the subject is the bullet, the message is its note. One routing rule serves every address, because subaddressing means in+<token>@ reaches the rule for in@, so a new address is a row rather than a change to any DNS. The address is the permission and the screen says so: whoever holds it may write into that one bullet and nothing else, the same bargain as a share link, revocable on its own.persona: plan blog 2026.03