Permissions and Collaboration

The service should support ownership, collaboration, campaign or continuity participation, and following.

User Relationships to a Project

A user may be:

• owner
• co-owner
• editor
• viewer
• GM
• player
• follower

These are not all the same.

Ownership

The owner controls the project and can grant access.

Collaboration

Collaborators help create or manage project material.

Suggested roles:

Owner       full control
Editor      can create and edit project data
Commenter   can leave comments but not change canonical state
Viewer      can see private collaborator-visible data

Continuity Participation

Campaign participants are tied to a campaign or continuity, not necessarily the whole project.

Suggested roles:

GM          can view and mutate continuity state
AssistantGM can view GM notes and help prepare material
Player      can see player-visible continuity material
Spectator   can view selected public or shared material

Follows

Following is lightweight.

A follower may receive updates for public posts, publications, or continuity journals, but should not automatically gain access to private project or continuity state.

Permission Checks

Permission checks should happen in application services, not only in the UI.

Example:

Can this account reveal this secret to this continuity?
Can this account edit this entity?
Can this account view this relationship?
Can this account publish this page?

Audit Trail

For collaborative work, important mutations should record who made the change.

Example:

User A changed Location.status from safe to occupied.
User B revealed Secret X to Continuity Y.