Permissions

This guide explains how permissions work in Mainbranch, including role-based access control and data-level permissions.

Overview

Mainbranch uses two types of permissions:

1. Role-based access control — Determines what features users can access
2. Data-level permissions — Determines what content users can see

Role-Based Access Control

Roles

Mainbranch has three user roles:

Role	Description
Owner	Full access to all features and settings, can delete workspace
Admin	Can manage settings, users, and connectors
Member	Standard access to search, AI, and tools

Role Capabilities

Capability	Owner	Admin	Member
Use AI Assistant	Yes	Yes	Yes
Access The Vault	Yes	Yes	Yes
View Meetings	Yes	Yes	Yes
Use Tools	Yes	Yes	Yes
View All Settings	Yes	Yes	No
Manage Members	Yes	Yes	No
Manage Connectors	Yes	Yes	No
Configure SSO	Yes	Yes	No
Configure AI Settings	Yes	Yes	No
Delete Workspace	Yes	No	No
Transfer Ownership	Yes	No	No

Changing Roles

Administrators can change user roles:

1. Go to Workspace settings > Members
2. Find the user
3. Select a new role
4. Save changes

Note

Role changes take effect immediately. The user may need to refresh their browser.

Data-Level Permissions

Permission Inheritance

Mainbranch inherits permissions from your connected data sources:

• Google Drive — File and folder sharing settings
• Microsoft 365 — OneDrive and SharePoint permissions
• Gmail/Outlook — Mailbox access
• Zendesk — Ticket visibility settings

How It Works

When a user searches in Mainbranch:

1. The search is performed across all connected sources
2. Results are filtered based on the user’s permissions
3. Only content the user can access in the source system is shown

Example:

• User A can see files shared with them in Google Drive
• User B cannot see User A’s private files
• The same visibility applies in Mainbranch search results

No Permission Bypass

Note

Mainbranch never shows content that a user cannot access in the original source. Your existing permissions remain in effect.

Permission Scenarios

Shared Documents

When a document is shared in Google Drive or OneDrive:

• Users with access see it in Mainbranch
• Users without access do not see it
• Changes to sharing update Mainbranch access

Personal Content

Private files and emails:

• Only the owner sees them in Mainbranch
• Not visible to other users or admins
• Admins do not have special content access

Organization-Wide Content

Company-wide shared content:

• Visible to all users
• Follows source system’s org-wide sharing

Vault Permissions

Uploaded Files

Files uploaded directly to The Vault:

• Visible to the uploader
• May have organization-wide visibility
• Depends on workspace configuration

File Access

Users can:

• See files they uploaded
• See files shared with them
• See organization-shared files

Permission Sync

Sync Timing

Permission changes sync from source systems:

• Most changes reflect within minutes
• Large permission changes may take longer
• Full permission sync occurs periodically

Forcing Sync

If permissions seem out of date:

• Wait for automatic sync
• Check source system permissions
• Contact administrator for connector status

Managing Access

For Administrators

Control access by:

• Managing user roles
• Configuring connector scope
• Reviewing connected sources

For Users

Control your content visibility by:

• Managing sharing in source systems
• Understanding what’s connected
• Reviewing your permissions

Feature Access

Controlled Features

Administrators can enable/disable:

• Web search capability
• File upload capability
• Chat history retention

These settings apply to all members.

Best Practices

For Administrators

• Use member role for most users
• Limit admin access to those who need it
• Review permissions regularly
• Document access policies

For Users

• Understand what content is searchable
• Use source system sharing appropriately
• Report unexpected access issues

Security

• Regularly review who has admin access
• Audit permissions periodically
• Keep source system permissions current

Troubleshooting

Cannot See Expected Content

• Verify access in the source system
• Check if content is in a connected source
• Allow time for permission sync
• Contact administrator

Seeing Unexpected Content

• Review source system sharing settings
• Content may be shared more broadly than expected
• Check team or organization sharing

Permission Changes Not Reflecting

• Allow time for sync
• Verify change was made in source
• Check connector status
• Contact administrator

Next Steps

• Configure SSO — Secure authentication
• Review Data Privacy — Data handling practices
• Return to Security Overview