BeforeQuery has three permission layers: workspace roles, project-level permissions, and document visibility. Together they control who can administer the workspace, which projects a member can ask questions against, and which documents each audience can see.

​
Workspace roles

Every workspace member has one of two roles: Assign roles when inviting members, or change them later from Workspace → Team.

​
Project-level chat permissions

The internal Ask assistant (the /api/v1/portal/* endpoints and the Ask section of the dashboard) is available to any workspace member — but which projects a member can chat with is permission-based:
  • Owners can chat with every project in the workspace.
  • Members can only chat with projects where they’ve been granted can_chat.
Owners manage these grants under Project → Permissions: toggle Can chat per member. The Ask section then shows each member exactly the projects they may chat with — and multi-project questions are scoped to that same set.
Internal Ask access is not gated by any public-portal setting — it follows these permission rules only.

​
Document visibility

Each indexed document is public or restricted: Use restricted for internal runbooks, pricing playbooks, or pre-release docs you want your team — but not your customers — to get answers from. Toggle a document’s visibility from its page under Project → Documents.

​
Scoping external access

For traffic outside your team (widget, SDKs, public API), access is governed by client keys, not roles: keys can be limited to specific source groups via allowed_groups, and requests can narrow retrieval further with group_ids (never widen). See Authentication.