4 access levels in WikiMind — so nobody “accidentally sees HR docs”

In WikiMind, we built a 4-level access model for documents — without hardcoding or magic along the lines of “well, ADMIN can do everything anyway.”

The setup is: workspace role (ADMIN/EDITOR/VIEWER/GUEST with 70+ permissions) → collection access (PRIVATE/READ/READ_WRITE) → personal access to a document → group access via LDAP.

The key point: our roles are not an enum in code, but records in the database with an array of permissions. That means the model can be tuned precisely for a specific company, instead of turning every new requirement into an enterprise quest.

And yes, ADMIN is not “god mode” for us: it has override on almost everything, except reading and favorites. That protects against the most common corporate scenario: access was granted “just in case,” and then someone accidentally wandered into the wrong place. Secure by design is no longer a trend — it’s the baseline.