Access and identity

Users and workspaces are both Accounts and can own Playbooks. Private sharing uses principals: User IDs and Project IDs. public is also a valid Playbook principal. Cases do not support public access.

Playbook and Case ACLs are independent. Starting from a public, shared, or project-readable Playbook does not copy its visibility into the Case. Choose a Case ACL explicitly because its input, outcomes, and Records may be more sensitive than the reusable guidance.

Authorization is evaluated against current ACLs. Record reads always intersect filters with the live Case ACL; an acl filter only narrows authorized results and never grants access. Suggestion access also rechecks the current target Playbook rather than relying only on the creation-time snapshot.

Ownership grants Playbook management rights. A readable user can create a Suggestion; the Suggestion author can edit an open proposal, while the Playbook owner resolves it. Aliases provide names, share tokens provide token-based reads, and stars provide personal saving—none changes ownership.

Use idempotency UUIDs for mutations. Reuse one only for the identical request after an uncertain response. Case and Task mutations additionally require lock versions so concurrent collaborators do not silently overwrite each other.