River
Ctrl K
Open River

Collaboration

Roles & Permissions

River has four levels of access control, each one nested inside the next.

Org role
  └── Dataspace membership
        └── Space access
              └── Entity / Group ACL

The default behavior of each layer is to inherit from the one above. You only need to configure access explicitly when you want stricter or looser than the default.

Org-level roles#

See Orgs & Members. Roles are: Owner, Admin, Member, Guest. Org role gates whether you can access the Org at all and what admin functions you have.

Dataspace membership#

Each Dataspace has its own member list. Org Members can be added or removed from individual Dataspaces.

Dataspace role Can do
Member Read and write all entities in the Dataspace by default
Read-only View but not edit
Guest Limited access — only entities explicitly shared with them

Within an Org, you'd often have most Members in the main team Dataspace, plus a smaller number with access to a Sensitive Dataspace.

Space access#

By default, every Space inside a Dataspace is visible to all Dataspace members. You can scope a Space to a smaller set of people if needed — useful for things like an exec-only planning Space inside a broader team Dataspace.

Entity and Group ACLs#

For the rarer case where one entity (or one Group) needs different access than its parent Space, you can set per-entity or per-Group ACLs:

  • Public to Dataspace (default for most entities)
  • Restricted — only specific people
  • Read-only for some, write for others

A practical pattern#

For 90% of teams:

  1. One Org per company.
  2. One team Dataspace where most work happens (everyone is a Member).
  3. Optionally one "Sensitive" Dataspace for HR/M&A/legal (small membership).
  4. Default Space access (open to all Dataspace members).
  5. Per-Group ACLs only when truly needed.

That's it. Don't over-engineer permissions.

Sharing externally#

When you share with someone outside the Org:

  • They receive a Guest invite scoped to the entity, Group, or Space you shared
  • They join River as a Guest if they don't already have an account
  • They see only what's been shared, nothing else
  • You can revoke sharing at any time

See Sharing for the workflow.

Tips#

  • Audit access at the Dataspace level, not the entity level. Most permission complexity goes away when you partition data into the right Dataspaces.
  • Guests are ideal for clients, contractors, advisors, and short-term collaborators.
  • Org Owners have unrestricted access. Keep that role to one or two trusted people.