How we at WikiMind built access control without “enum magic”
When your product has documents, teams, and LDAP, the “ADMIN/USER” model dies the moment you take it to an enterprise demo. So we built a 4-level access model with roles, collections, and per-document and group access.
When your product has documents, teams, and LDAP, the “let’s just do ADMIN/USER” model dies at the first enterprise demo 😅 So we built a 4-level access model:
- a workspace role:
ADMIN / EDITOR / VIEWER / GUESTwith 70+ permissions - collection access:
PRIVATE / READ / READ_WRITE - per-document access
- group access through
LDAP
The key point: our roles are not a hardcoded enum, but records in the database with an array of permissions. That means each organization can safely tune its own permission matrix without shipping a release for every small change.
Another important detail: ADMIN has an override for almost everything, except reading and favorites. That may sound unexpected, but it prevents accidental access to someone else’s documents — the classic “opened the wrong thing during a call” case.
In the age of zero trust and corporate paranoia, this is no longer a feature, it’s table stakes.