Permissions and public links

Apply the object’s access boundary

The server checks project access and your project role on every scoped operation. Each project has one owner, who manages owner-only settings, members, roles and integrations. Members work on project content. Readers can read it and, when the owner turns on Can comment for them, comment; they cannot edit content or publish links, and they do not see integrations or share and board tokens. The project roles table lists each role's access. A client hiding a control is not authorization. Personal account settings, notebook and owner-only Numo chats do not become shared when a project is attached as context. MCP acts as its authorized account and follows that account's current role in each project on every call; it does not turn an agent into an instance administrator. Project integrations with mdy_ keys are not people: they keep the fixed permissions of their kind and receive no role.

A role change or removal applies to the next request. Content already delivered is not recalled, and a signed URL already issued for a private file stays valid until it expires, at most 10 minutes later.

Understand what a publication exposes

A published page or shared view uses an opaque bearer link, optionally protected by a password. The owner and members can publish and revoke these links; readers cannot. Anyone with the link and, when required, its password can access the published content. Revoke the link when no longer needed. Public page subpages resolve only inside the published set; excluded child titles are not exposed. Attachments are signed only for published pages while the private bucket and authenticated application routes remain closed. Mentions may remain text without private profile links. A published database includes only entries in its published branch.

Check sharing and revocation anonymously

Open the result in a separate signed-out session, inspect the intended content and files and verify excluded objects remain inaccessible. Revoke the publication and test the link again. Already copied data cannot be recalled, and a previously issued signed file URL can remain valid until expiry; file URLs issued for a published page last 24 hours. User secret links remain noindex, separate from this indexable official documentation. Noindex is a crawler instruction, not an access control. Never paste private bearer links into public reports or documentation examples.