Who can actually read your private notes
Private, company, public — three scopes, one enforcement point. Why the check has to live in the query, and not in the AI client's good behaviour.
"Can my admin read my private notes?" is the first question anyone sensible asks about a shared knowledge tool, and the answer most products give is a shrug dressed up as a permissions matrix.
In Verde the answer is no, and the reason is worth spelling out, because it is a design decision rather than a promise.
Three scopes, and only three
Every document lives in exactly one scope:
- Public — your external knowledge base. Anyone on the internet, no sign-in.
- Company — signed-in members of the team. The default for most things.
- Private — one member. Invisible to everyone else, including owners and admins.
Three is deliberate. Scope systems fail by growing: once there are nine overlapping levels, nobody can predict what a given document is visible to, and people either over-share by accident or stop writing things down. Three you can hold in your head.
Where the check lives
This is the part that matters. The permission check runs server-side, in the query itself — not in the application layer above it, and emphatically not in the AI client.
The distinction is not academic. Consider what an AI client is: a program that receives a tool description, decides what to call, and reports back. If your privacy model depends on that program behaving correctly, then your privacy model is a suggestion. A misbehaving client, a prompt injection in a document, or an ordinary bug is enough to defeat it.
So the rule is: a private memory never crosses users, and the query is what enforces it. Workspace, role, bucket and private-ownership rules are all applied at the point the data is fetched. There is no code path where a document is loaded and then filtered out, because "loaded and then filtered" is one refactor away from "loaded".
We verify it the same way: an end-to-end suite that tries to read another member's private document as an owner, on every release, and fails the build if it ever succeeds.
What this means for AI
A token acts with exactly its owner's permissions. Connect Claude with your token and it can see what you can see — your private notes among them, because they are yours.
Connect it with a read-only teammate's token and it sees the company scope and their own private documents, and nothing else. The AI does not get a special view, an elevated view, or a flattened one. It gets your view.
That is the property that makes the rest of it safe to build on. Everything else — publishing, supersession, activity — assumes the boundary holds, so the boundary is the thing worth being uncompromising about.
