Sharing & Permissions
Understand how visibility, ownership, and organization access work across capsules, types, and projects.
Symbol gives you precise control over who can see and edit your knowledge. This page explains how visibility works for each resource and what different organization roles can do.
Ownership
Every capsule, type, and project belongs to the user who created it. Ownership never transfers automatically. As the owner you always have full access — read, edit, share, and delete — regardless of any other settings.
Visibility Levels
Both capsules and types support four visibility levels. You can change visibility at any time from the resource's settings.
| Level | Who can read | Who can edit |
|---|---|---|
| Self (default) | You only | You only |
| Org View | You + all organization members | You only |
| Org Edit | You + all organization members | You + organization editors and owners |
| Link | Anyone with a valid share link | You only |
A few rules that apply to all levels:
- Deleting a resource and creating share links are always owner-only actions, even when visibility is set to Org Edit.
- Setting visibility to Org View or Org Edit requires selecting an organization.
- Encrypted capsules cannot be shared. Visibility is permanently locked to Self and share links cannot be created for them.
Types and Organizations
You can share a type with an organization so members can see its name, guidance, and structure. This is useful when you want everyone in the organization to understand how a category of knowledge is organized.
Sharing a type with an organization does not automatically share the capsules inside it. Type visibility and capsule visibility are independent — an organization member who can see a type may not be able to see any of its capsules unless those are shared separately (or added to a shared project).
Projects
Projects are named collections of capsules. They are a way to group related capsules across different types into a single view — for example, a "Q1 Onboarding" project that pulls together solutions, decisions, and prompts relevant to onboarding new engineers.
Key rules for projects:
- A capsule can belong to one project at a time.
- A project can contain capsules from any type.
- If a project is deleted, its capsules are not deleted — they simply return to your library unassigned.
- If a capsule's type is deleted, the capsule is deleted regardless of project membership.
Sharing a Project with an Organization
Projects have their own visibility setting, separate from the capsules inside them:
| Level | Who can see the project | Who can add or remove capsules |
|---|---|---|
| Self | You only | You only |
| Org View | You + all organization members | You only |
| Org Edit | You + all organization members | You + organization editors and owners |
A project set to Org Edit or Org View must have an organization assigned. If the organization is later deleted, the project's visibility automatically reverts to Self.
Note that an organization member seeing a project will only see the capsules within it that they have permission to access. Capsules that are still set to Self will not appear for other organization members even if the project is shared.
MCP Access for Organizations
When using an AI assistant (such as Claude via the MCP server), access to shared organization resources requires an extra opt-in step. Each user controls whether their AI assistant can access each organization's shared content via the MCP Access toggle in their account settings.
This is per-organization and per-user. Enabling MCP access for one organization does not affect other organizations. Users accessing Symbol through the web UI are not affected by this toggle.
Prompt Safety Classification
When you publicly share a capsule whose Type uses the prompt render template, Symbol runs an automated, best-effort safety check on the prompt body. The recipient sees a risk level and a short reason:
- Low — the prompt renders normally.
- Medium — a non-blocking caution appears above the still-visible, still-copyable prompt.
- High — the prompt body and copy controls are withheld until the recipient acknowledges the risk.
Classification runs in the background, is cached per prompt body, and fails open: if the classifier is disabled or unavailable, sharing and viewing still work and the prompt renders ungated. The score is a signal, not a guarantee — a prompt scored safe may still be risky, and vice versa. See the Terms of Use for the full disclaimer.
Quick Reference
| Question | Answer |
|---|---|
| Who can delete a capsule? | Owner only |
| Who can create a share link? | Owner only |
| Does sharing a type share its capsules? | No — they are independent |
| Can a capsule be in multiple projects? | No — one project at a time |
| What happens to capsules when a project is deleted? | They stay in your library, unassigned |
| Can an AI assistant access organization content automatically? | Only if MCP Access is enabled for that organization in your settings |
| Can an encrypted capsule be shared? | No — sharing is permanently blocked for encrypted capsules |