Permissions that don't require an admin manual

Every permission system we looked at before building our own started from the enterprise case: org charts, nested groups, dozens of role types. That's the right answer if you're rolling out to five thousand people. It's the wrong answer if you're a 5-person team trying to share one folder with a contractor without giving them the whole workspace.

So we designed Hubcove's permission model from the small end first. Every workspace starts with two roles — member and guest. A guest can be invited to a single folder and sees nothing else; there's no way to accidentally expose the rest of the workspace to them. That covers the contractor case, the client-review case, the vendor case, without any configuration.

As workspaces grow, the same model scales up rather than switching to a different one: folder-level roles, subfolder scoping, and — as of 2.3.0 — an audit log so admins can see who accessed what. But the mental model stays 'invite someone to a folder', not 'design a permission matrix'. Business customers who need SSO and audit logs get them without the base model changing underneath them.

The tradeoff is that we deliberately don't support some things a full enterprise IAM system would: no custom role definitions, no attribute-based access rules. We'd rather stay legible than cover every edge case a spreadsheet of permissions can express.