Understanding Who Can See Your Documents
Knowing who can access a document is essential for maintaining data privacy and for making sure colleagues can find what they need. Essal Office uses a layered permission model that determines visibility based on ownership, object-level grants, and global roles.
Layer 1: The Document Owner
The user who owns a document always has full access to it. That includes viewing, editing, and deleting. By default, the person who uploads a document becomes its owner.
Layer 2: Admin Users
Users with the Admin (or Superuser) role can see and manage all documents, regardless of ownership or permissions. Admins have system-wide access by design. Keep the number of admin accounts to a minimum — typically to IT staff or senior managers.
Layer 3: Explicit Permissions
The document owner or an admin can grant specific users or groups explicit access to a document. Permissions can be as narrow as read-only view, or as broad as full edit and delete rights.
If someone tells you they cannot find a document you expect them to see, check whether they have been granted view permission either directly or through a group.
Layer 4: Global Permissions (System-Wide)
Admins can configure system-wide settings that change the default visibility. For example, a setting may allow all authenticated users to view all documents by default (common in smaller teams where privacy between colleagues is not a concern). These settings determine the baseline — document-level permissions then add exceptions on top.
What Other Users Without Permissions See
If User A has no permissions on a document owned by User B: - The document does not appear in User A's search results or list - If User A navigates to the document URL directly, they see an access denied message - The document is effectively invisible to them
Checking Who Has Access
To review access on a specific document:
- Open the document
- Click the Permissions tab or icon
- Review the Owner, Users, and Groups sections to see who currently has what level of access
Practical Access Design
For most small teams, a simple approach works well:
- Scenario: All staff see all documents
- Recommended setup: Set global default to allow all authenticated users to view
- Scenario: Department-level access
- Recommended setup: Create one group per department; grant groups view on relevant documents
- Scenario: Fully private documents
- Recommended setup: No extra action needed — only the owner and admins see them by default
- Scenario: Temporary external access
- Recommended setup: Use a share link (no account needed)