Permissions & Security

-- Policy ensures users only access their org's data
CREATE POLICY org_isolation ON documents
FOR SELECT USING (
  organization_id = current_user_org_id()
);

interface ACL {
  document_id: string;
  principal_type: 'user' | 'group' | 'channel';
  principal_id: string;
}

Document: "Sales Strategy 2024"
ACLs:
  - user:john@company.com
  - group:sales-team
  - channel:C123ABC (Slack)

Sales Team:
  members:
    - john@company.com
    - sarah@company.com
  integrations:
    google-drive: /Sales/*
    slack: #sales, #sales-emea
    notion: Sales Playbook
  permissions:
    query: true
    export: false
    analytics: team_only

SELECT d.*
FROM documents d
WHERE d.organization_id = $org_id
  AND (
    -- User has direct access
    EXISTS (
      SELECT 1 FROM acls
      WHERE document_id = d.id
        AND principal_id = $user_id
    )
    OR
    -- User's group has access
    EXISTS (
      SELECT 1 FROM acls
      WHERE document_id = d.id
        AND principal_id IN ($user_groups)
    )
  );

interface QueryLog {
  id: string;
  user_id: string;
  organization_id: string;
  question: string;
  sources_accessed: number;
  documents_returned: string[];
  timestamp: Date;
}

Engineering Department:
  members: [eng-team]
  sources:
    github: all repos
    slack: #engineering, #dev-ops
    notion: Engineering Wiki
  restrictions:
    exclude_slack: #sales, #hr
    exclude_drive: /Sales/*, /HR/*