Skip to content
Raw Markdown

Domain permissions

Use restricted write access when editors should own specific parts of the context instead of changing everything.

  1. Under Settings → Users, place editors into permission groups.
  2. In the project settings, change Write access from Open to Restricted.
  3. Grant each group write access to a domain. The grant includes its subdomains unless you add a None carve-out.
  4. Verify that an affected editor can change an allowed domain and sees disabled controls elsewhere.

For example, Finance owns the Sales domain, where revenue and active_customers live. Grant the Finance group write access to that domain. A marketing editor can still read both metrics and ask questions that use them, but their edit controls in Sales are disabled. Check it signed in as that editor, not as an admin.

Everyone keeps read access to the context. Admins always retain write access.

Permissions apply to writes attributed to a Cassis member, including Explorer and Assistant edits and CLI uploads authenticated as that member.

Domain grants do not gate GitHub merges or GitHub App imports. Enforce repository ownership with CODEOWNERS, required reviewers, and branch protection. If your own pipeline runs cassis context upload, the API key owner’s Cassis permissions apply.

For organization-wide capabilities, see Members and roles.