amadan
Private-document isolation and explicit secure sharing across teams open
Paul requirement, 2026-09-09; filed for architecture work, not an approved implementation design.
“sharing across teams will be imperative” “a non-shared document within a team should be verifiably secure, and not just protected by a permission record in the database” “Explicit sharing to specific documents outside of a team should also be possible, and also secure.”
Required outcome: explicit document-scoped external sharing must coexist with verifiable isolation of unshared content. An external recipient must not gain team membership or access to other documents merely by accepting a share. A database permission flag alone does not satisfy the isolation requirement.
Design work: define the threat model and independently enforceable boundaries, including other team members, other tenants, compromised app processes, database access, Home/identity compromise and operators. Decide which guarantees require separate key custody, cryptographic document capabilities, process/storage isolation or client-side encryption. Do not claim end-to-end encryption or resistance to a compromised server merely because teams have separate instances or data is encrypted at rest.
Specify recipient identity and document/action binding, grant issuance, expiry and revocation, key handling, attachments/history/comments/search/AI-derived content, auditability, and fail-closed behavior. Tests must show a recipient cannot enumerate or retrieve unshared content, broaden a grant by editing permission metadata, or retain future access after revocation within the stated bound. Copies already legitimately downloaded cannot be recalled; distinguish those from future service access.
Related proposal to evaluate: one instance per workspace per app, including Personal as a workspace of one; durable personal sign-in identity, explicit personal versus organisation ownership, and permitted move/copy/export on leaving a university. This topology is a proposal, not a settled security mechanism. Do not merge identities by email or automatically transfer organisation-owned content.
Amend the suite sharing doctrine and affected Home/app citations through security review before implementing this model. Correct the earlier conversational claim that all sharing currently stays within a team: existing doctrine/app designs already include guest/document grants; identify exactly which guarantees they provide and which this requirement strengthens. Review the existing whole-team trust-domain assumption against private-document isolation rather than silently preserving it.
No tenancy migration, customer provisioning, key migration or new sharing path is authorized by this filing alone. Existing launcher work can continue without changing these boundaries.