Skip to main content
Everything in Summand is private to the people who have access to it. There are no public links and no anonymous access. Access comes from two places: direct grants to specific people or domains, and workspace filing, which gives workspace members access to what’s filed in the workspace.

​
Direct grants

A grant gives a user, or everyone on a verified email domain, a role on a dataset or connector. There is exactly one owner per connector (the creator, by default), and the owner of a connector owns its datasets. Only the owner can delete or transfer a connector. Authorization is enforced through OpenFGA, the same engine that powers permissions in the rest of the product. You can grant access to:
  • A user, by email address.
  • A domain, such as everyone at yourcompany.com. The domain must be verified for your organization in WorkOS.

​
Workspace visibility

A connector can be filed in a workspace. Members of that workspace then get access to the connector and its datasets with their workspace role. Views, experiments, components and models inherit access from the resource they’re built on. Each one has one of two visibility settings: Workspace admins can also give every workspace member Editor access to a single resource.

​
Granting access

From the dataset’s Share dialog:
1

Enter a teammate's email

Summand checks if they have an account. If they do, the grant takes effect immediately.
2

Pick a role

Viewer, Editor or Admin. Ownership can only be transferred, not added.
3

Invite them if they're new

For email addresses without an account yet, Summand saves a pending invitation. The grant becomes active when they sign up. Pending invitations expire after 30 days.
You can revoke a grant at any time. Revocation is immediate: the next authorization check fails closed.

​
Audit trail

Every grant change (added, role changed, revoked) is recorded with timestamp, actor, subject, the role before and after, and the request’s IP address. See Audit logs. Enterprise customers can request an export of these records for their own compliance reviews.

​
Sharing connectors

You can also share an entire connector rather than individual datasets. A connector grant gives access to every dataset under that connector, including new ones created later. This gives a team durable access to a database without re-granting for each new table.

​
Filing and publication

Summand separates ownership from consumption:
  • Filing is single-parent. A connector is filed in at most one workspace, and its datasets follow it.
  • Publication is multi-target. Resources can be shared with additional users or domains without changing where they’re filed.
You can see who owns a resource (filing) separately from who has read access (workspace members and direct grants). All authorization goes through OpenFGA, so the same answer is given regardless of whether the request comes from the UI, the API, or an internal Lambda.