Access and identity

Users and workspaces are both accounts and can own playbooks. Cases and playbooks both use visibility (private or public). public is a read-only ACL sentinel: it grants access to published content only, never to unpublished work, and never to edit or manage.

For a case, published content is the public title, input, records, and readable handoff neighborhood. Tasks, assignment, and collaborator identities stay with the work ACL. Anyone on that ACL can still read the working case and, while it is open, edit the work: tasks, assignment, title, closing, reopening, handoffs, appending records, requesting an Epismo AI review, and whether OUTPUT records enqueue one. Public readers can get a public case without signing in. The current assignee chooses public/private and can archive the case; started_by is history and keeps access after reassignment only if they remain on the ACL as an editor.

For a playbook, published content is the latest version. Drafts follow edit access. Editors (active user account or team IDs) can read and edit content. The owner is implicit, is never listed as an editor, and can always read, edit, manage access, and archive. For a workspace-owned playbook, every member of that workspace can read and edit it and is also omitted from the editor list; workspace Owners and Admins are owner managers who additionally manage access, public visibility, and archive.

Case and playbook ACLs are independent. Starting from a public, shared, or team-readable playbook does not copy its visibility into the case. Choose a case ACL explicitly because its input, outcomes, and records may be more sensitive than the reusable guidance. Making a case public is a separate, explicit step.

Reassigning a case preserves the former assignee’s edit access: if no remaining grant covers them, the service adds their user account ID to the editor list. Similarly, transferring a personally owned playbook preserves the former user owner’s edit access. A former workspace owner is not automatically added as an editor. Changing responsibility or ownership therefore does not by itself revoke the former user’s access; review the editor list separately if access should be removed.

The current case assignee has implicit work and management access and is omitted from the stored editor list. An empty editor list is valid. Access updates must preserve every task assignee's work access through explicit editors, teams, or that implicit grant.

Authorization is evaluated against current ACLs. Record reads of the live case always intersect filters with the live case ACL; an acl filter only narrows authorized results and never grants access. Public readers receive the published projection, not tasks or collaborator identities. Suggestion access also rechecks the current target playbook rather than relying only on the creation-time snapshot.

Only an owner manager can manage playbook access, archive the playbook, or archive a historical version. The latest version cannot be archived. A readable user can create a suggestion; the suggestion author can edit an open proposal, while the playbook owner resolves it. Aliases provide names and share tokens provide token-based reads—none changes ownership.

Use idempotency UUIDs for mutations. Reuse one only for the identical request after an uncertain response. Case and task mutations additionally require lock versions so concurrent collaborators do not silently overwrite each other.