Sharing & Permissions

Symbol gives you precise control over who can see and edit your knowledge. This page explains how visibility works for each resource and what different organization roles can do.

OwnershipCopy Anchor Link

Every capsule, type, and project belongs to the user who created it. Ownership never transfers automatically. As the owner you always have full access (read, edit, share, and delete) regardless of any other settings.

In an organization workspace, the workspace's owner and Admins can also delete, change the visibility of, and manage share links for content other members created, and can edit and delete other members' projects. This applies only to content shared in the workspace: a member's Private draft stays visible to, and manageable by, only its creator, even from an owner or Admin. In your personal workspace, these actions remain owner-only.

Visibility LevelsCopy Anchor Link

Capsules, types and collections support these visibility levels. You can change visibility at any time from the resource's settings.

A few rules that apply to all levels:

• Deleting a resource and creating share links are owner-only in your personal workspace. In an organization workspace, the workspace owner and Admins can also do both to content other members created (a Private draft stays owner-only).
• Setting visibility to Org View or Org Edit requires selecting an organization.
• Encrypted content cannot be shared. Visibility is permanently locked to Private and share links cannot be created for encrypted capsules, encrypted Types, or collections in an encrypted Type, because a link holder has no key to read them.
• Viewers are read-only. An organization member with the Viewer role can read, but cannot edit, share or change the visibility of anything in that organization, including things they created before becoming a viewer.
• New capsules are no more open than their type. In an organization, a capsule created in a type set to Org View starts as Org View, and one created in a type that is Private, or shared only by link, starts as Private.
• A share link never gives your organization access. Putting a link on a capsule or type that is Private to you lets the people you send the link to open it, and no one else: your teammates do not gain access to it, before or after the link expires. To give the whole organization access, use Org View or Org Edit.
• A share link never takes your organization's access away either. Choosing Anyone with link on a capsule or type shared at Org View or Org Edit adds outside access and leaves your teammates' access exactly as it was. The share dialog then shows Anyone with link and says what your organization can still do. Choosing an Org level while a link is live ends the link.
• If a link took a type away from your organization before this was fixed, open the type's share settings and choose Org Edit (or Org View) to give your organization access again. Choosing an Org level ends the link, so share the link again afterwards.
• Private is the only choice that removes your organization. On organization content, the share dialog asks before it makes something Private, and says how many share links will stop working.
• Public is not available for organization content yet. The share dialog does not offer it there, and says so.
• Encrypting, deleting, or deleting the organization ends every link too. Like making content Private, each of these stops every existing link from opening it. Turning on encryption for a whole type ends the type's library link and every link to a capsule inside it, and an encrypted type can no longer be shared by link. Deleting the organization ends every link on its content.
• A deleted capsule's link shows "Content Removed". Opening a link to a capsule you have deleted shows a plain notice, never its former content, and the link accepts no further views, likes, copies or saves.
• Moving something from Public back to Anyone with link stops its /u/<username>/<slug> address at once. You get the item's share link to hand out instead, and every link you sent to people before keeps working.
• A capsule's badge says how open it is. Link (amber) means anyone with a link can open it. Public (green) means it is also listed on your profile and in Discover.
• Duplicating a capsule needs edit access to it. If you can only view a capsule, you cannot make a copy of it, and the Duplicate action is not offered.

Sharing with specific peopleCopy Anchor Link

A link lets anyone who holds it in. To show something to exactly the people you mean, share it with them by name instead. Open Share on a capsule, a Type or a Collection and use the People section:

• Add someone by email. Pick View or Edit and press Add. They get an email and find the item under Shared with me once they sign in with that address. Only they can open it: anyone else, including other members of your organization, still gets "not found".
• Every invitation reads the same. The person shows as "Invited, not yet joined" until they first open Shared with me, whether or not the address already has a Symbol account, so the list never tells you who uses Symbol. Someone who signs up later with that address, and verifies it, finds the item waiting for them.
• View lets a person read the capsule, its version history from the moment you shared it on, its attachments, and the capsules it references that they can also see. Edit also lets them change its title, summary, body and fields, and each change is recorded in the version history under their name. People you share with can never share it on, move it, delete it, archive it or change who can see it.
• A Type or Collection shows each person exactly what a link on it would publish: the capsules you created there that are not Private in an organization, not encrypted, and not kept out of library links. Turning Include in library links off on a capsule removes it for them too. They browse it at Shared with me in the same library view a link shows.
• Change or remove a person from their card in the People section. Removing someone ends their access at once, everywhere: the item, its versions, its attachments, Shared with me and their AI assistant. A person can also leave something shared with them, from Shared with me.
• In an organization, content can be shared only with members of that organization; to share it outside the team, use a link. This is how you show a Private draft to one teammate without the whole organization seeing it. A member who is a viewer in the organization can only be given View.
• Encrypted capsules cannot be shared with people, for the same reason they cannot be shared by link: Symbol has no key to give them.
• You can share one item with up to 50 people, and add up to 30 people an hour.

Your AI assistant can do the same with the manage_people_access tool, and can list what was shared with you by name.

Your linkCopy Anchor Link

Each capsule, type and collection has one reusable share link. Choosing Anyone with link, pressing Copy link, or asking an assistant for the link all give you that same link, however many times you ask and after a reload. A new link is made only when you ask for one.

• New link… in the share dialog makes a separate link, with its own expiry and view limit if you set them. Give it to one person and revoke it on its own later, and your other links keep working.
• Links made before links were reusable are listed with their views and expiry and can be revoked, but their address can't be shown again. Revoke one and make a new link if you need to send it again.
• In an organization, a workspace owner or Admin can list and revoke the links members made on shared content, but is never shown a member's link address.

Share Links, Expiry and View LimitsCopy Anchor Link

A share link can carry an expiry date, a view limit, or both. Set them under New link… in the share dialog of a capsule, a type or a collection: Expires offers 1 day, 7 days, 30 days or a date you choose, and View limit takes any whole number.

• Expiry: after the date passes, the link stops working everywhere. The date must be in the future: a link that would expire before anyone could open it is refused, and nothing about your sharing changes.
• View limit: counts visits, not page loads. Someone you send the link to sees a short page with an Open button. Opening uses one view and starts a visit that lasts an hour. Within that visit they can browse the whole library, search it, open cards, see images and download attachments, like it, and save one copy of each capsule, without using any more views.
• Link previews and scanners are free: a chat app unfurling the link, an email scanner, or a search crawler sees only the title, never the content, and never uses a view. Only a person pressing Open does.
• Your own views are free: opening your own link while signed in never uses a view, so you can check it before sending it.
• Assistants and the API count each content read: when someone reads a capsule's content through an AI assistant or the API, each read uses one view, and each saved copy made without a visit uses one too. Checking what a link points to is free: a Type or Collection link returns its name and how many capsules it holds without using a view.

What each link saysCopy Anchor Link

The share dialog lists every link to the item, newest first, with when it was made, the views it has used (against its limit, as in "0 of 2 views"), and when it expires. Each link has Copy and Revoke. Revoke asks once before it ends the link. It also says what each one does now:

• Active: it opens.
• Expired: its date has passed.
• View limit reached: it has used every view.
• Public listing link: the link that publishes a Public item. It has no Revoke button: to stop publishing, choose Anyone with link or Private.

Once no link on an item still opens (they expired, ran out of views, or were revoked), the item reports itself as Private again, and the dialog stops saying anyone with the link can view it.

Someone who opens a link that no longer works sees one page whatever the reason: it says the link may have expired, reached its view limit, or been withdrawn, and suggests asking you for a fresh one. It never says which, so it cannot be used to probe links.

All your links in one placeCopy Anchor Link

Settings > Share links lists every link you have made, across capsules, types and collections, newest first. Each row names what it shares, when it was made, its views and its expiry, and offers Copy when the address can be shown.

• Revoke one link, select several and choose Revoke selected, or choose Revoke all. Revoke all asks first. A revoked link stops working at once.
• Items you have made Public are listed as Published with Manage, which opens the item. Revoking links never unpublishes anything: choose Anyone with link or Private in the item's share dialog to do that.

Publishing in one stepCopy Anchor Link

Choosing Public in a share dialog tells you straight away if anything is missing:

• No username yet: the dialog offers Claim a username to publish. Claiming one is a one-time step in Settings > Public Profile. Once you claim it, you come back to the capsule and it is published, with its address shown in the dialog, with no further clicks.
• Public profile off: Enable public profile & publish turns your profile on and publishes the item in one step.

An assistant gets the same answer: it can publish a capsule and tell you its address, or tell you which one-time step is missing and where to do it. A username can only be claimed in a browser.

Your public addressCopy Anchor Link

A Public item is reachable at /u/<username>/<slug>, where the slug is its alias (for a capsule) or its slug (for a type or collection).

• An address belongs to one item, permanently. Once an item has been published at an address, no other item of yours can take it, even after the first item is made Private or deleted. So a link someone posted can only ever reach the item it was made for, or the "no longer available" page, never something else. If you publish an item whose alias another of your items already used publicly, Symbol refuses and names that item, so you can choose a different alias.
• Renaming keeps posted links working. If you rename the alias or slug of a Public item, its old address redirects to the new one. Making the item Private stops both.
• Capital letters do not matter. /u/Ada/Bio and /u/ada/bio reach the same page.

Turning off your public profileCopy Anchor Link

Turning off your public profile in Settings unpublishes everything you have made Public. Symbol asks first and says how many items that is. When you confirm:

• their public addresses stop working, they leave Discover, and their embeds are removed;
• each item becomes Anyone with link if you had sent a link to someone, or Private if not;
• links you sent to people keep working.

If anything goes wrong part way, nothing changes: your profile stays public and every item stays published.

Saving from a Shared LinkCopy Anchor Link

Someone who opens your share link without a Symbol account can still keep what you shared.

• Save keeps a copy in their own free Symbol library, ready to use from their AI assistant. The page says so next to Sign in to save.
• Signing in or signing up returns them to the page. This works from Sign in to save, from the heart, and from Log in and Get started at the top of the page. It also works after a new account confirms its email address, even when the confirmation link is opened on another device: after they sign in from the "Email verified" page, they land back on the shared page.
• One step is left, and it is theirs. Back on the page, a note says they are signed in and the Save button is ready. Saving still asks them to confirm that they trust the content, so nothing is saved for them without that. For a prompt behind a safety notice, the note asks them to review the notice first.
• Liking works the same way. After signing in from the heart, a note asks them to press the heart, and one tap likes it. A like is never added for them.
• View limits still apply. Coming back within the same visit uses no extra view. If they confirm their email later, they come back to the link's Open page while it still has views left.

Choosing where a saved copy goesCopy Anchor Link

If you belong to an organization, the Save dialog has a Save to list: Personal, plus each organization you can add content to. A copy saved to an organization lands in that workspace's General type (or in a type of the same shape, for content with fields), and your teammates see it as they see anything new there. Organizations where you can only view content are not in the list. If you leave the choice on Personal, the copy goes to your own library, as always.

Saving something into the workspace it already lives in does nothing, because you already have it there. Symbol offers Make a personal copy instead.

Personal copies of team contentCopy Anchor Link

Every capsule you can open in an organization has Make a personal copy in its menu, including content you can only view. The copy goes into your personal workspace as a Private capsule that only you can see and edit, in a type of the same shape. The original is not changed. This is the way for a view-only member to take something and work on it.

Encrypted team content can't be copied this way, because its contents are only readable with the team's key.

When an Organization Turns Off Outside LinksCopy Anchor Link

An organization's owners and Admins can turn off Allow links outside the organization in the organization's settings. While it is off, every share link on that organization's capsules, Types and Collections stops working, for everyone, and no new link can be created on its content. Your personal content is never affected.

The links are suspended, not deleted. When the setting is turned back on, they work again without anyone having to share anything a second time. A link that reached its expiry date while it was suspended stays expired. See Links outside the organization.

Types and OrganizationsCopy Anchor Link

You can share a type with an organization so members can see its name, guidance, and structure. This is useful when you want everyone in the organization to understand how a category of knowledge is organized.

Sharing a type with an organization does not automatically share the capsules inside it. Type visibility and capsule visibility are independent, with one exception below. An organization member who can see a type may not be able to see any of its capsules unless those are shared separately (or added to a shared project).

Switching a type from Org Edit to Org View also makes the Org Edit capsules in it view-only, so locking the type down locks its content too. Before anything changes, the share dialog says how many capsules by how many people it will make view-only. Switching the type back to Org Edit restores exactly those capsules, even if it was made Private in between, except any whose access someone changed in the meantime. A capsule its author made view-only on purpose stays view-only.

Making a type Private means only you can open it and add to it. Capsules your teammates can already see stay visible and editable to them; change that on each capsule.

Private (Self) capsules stay private everywhere, not only when opened directly. A teammate never sees another member's Private draft, or a capsule shared only by link, in lists, search, counts, references, backlinks, the graph, project or type context, the library, attachments, or sync, and an organization API key never sees anyone's Private drafts.

LibrariesCopy Anchor Link

Sharing a whole type or collection by link, or listing it publicly, publishes a library page. A library link publishes the capsules you created in it that your workspace can already see:

• In your personal workspace, that is every capsule you created there.
• In an organization, it is the capsules you created that are not Private. A Private draft is never published, even inside a shared library.
• Capsules created there later are included automatically.
• Capsules your teammates created are not included in your link.
• Encrypted and archived capsules are never included.

Before you choose Anyone with link or Public, the share dialog tells you how many capsules the library will publish, and repeats the number once it is published.

To keep a single capsule out of every library link, open its Share settings and clear Include in library links. While a library link reaches a capsule, its Share settings name that link instead of saying only you can access it. When a member leaves an organization, the capsules handed over to you are kept out of your existing library links until you include them.

Putting a capsule into a shared library publishes it, so adding a capsule to a shared collection, or moving one into a shared type, needs the right to share that capsule (only its owner has it). An API key also needs the share scope for this.

Collections in an organizationCopy Anchor Link

Anyone who can add to a type can add capsules to its collections, and remove the capsules they created. Renaming or deleting a collection, or removing capsules other people created from it, needs the person who created the collection, or an organization owner or Admin. A removal that includes someone else's capsule is refused as a whole and names those capsules, so nothing is half removed.

When a teammate edits shared contentCopy Anchor Link

Every edit records who made it, including edits to log entries.

• In the app, a log entry someone other than its author edited shows both names: "author, edited by editor".
• On a shared page, an "Edited by" line appears when someone other than the person the page credits last changed the content. For a log entry, that is the entry's author; for a capsule, it is the person who shared the link you opened. The line names the person who shared the page by their public name, and anyone else as "a team member". A teammate's account name never appears on a shared page.
• The people the content is shown under get an email. For a log entry, its author. For a capsule, its creator and whoever created each link that opens it. The person who made the edit is never emailed, and each person gets at most one email a day for each teammate and capsule. Nothing is sent for content no share link opens.

Version history when you shareCopy Anchor Link

When you share a Private capsule with your organization, teammates see its edits from that moment on. Versions written before you shared it stay private, so text you cleaned up before sharing is not exposed. Teammates who can edit the capsule can restore or delete only the versions they can see. As the owner you always see the full history. A capsule created directly in your organization was never private, so teammates see all of its history. See how long revisions are kept for what a teammate can restore.

The same holds for a Type. When you share a Private Type, teammates see its guidance history only from the moment you shared it, so guidance you wrote and removed while it was Private stays private. Teammates who can edit the Type can restore or delete only the versions they can see.

ProjectsCopy Anchor Link

Projects are named collections of capsules. They are a way to group related capsules across different types into a single view, for example, a "Q1 Onboarding" project that pulls together solutions, decisions, and prompts relevant to onboarding new engineers.

Key rules for projects:

• A capsule can belong to one project at a time.
• A project can contain capsules from any type.
• If a project is deleted, its capsules are not deleted. They simply return to your library unassigned.
• If a capsule's type is deleted, the capsule is deleted regardless of project membership.

Sharing a Project with an OrganizationCopy Anchor Link

Projects have their own visibility setting, separate from the capsules inside them:

A project set to Org Edit or Org View must have an organization assigned. If the organization is later deleted, the project's visibility automatically reverts to Self.

Note that an organization member seeing a project will only see the capsules within it that they have permission to access. Capsules that are still set to Self will not appear for other organization members even if the project is shared.

A project in your personal workspace has no organization to share with, so it is always Private. Share it with a link (below), or move it to a team.

Project linksCopy Anchor Link

You can share a whole project as one link. Open the project and choose Share, then Anyone with link, and copy the link. Anyone who has it can browse the project without a Symbol account: its capsules appear as cards, grouped by type, and each card opens the capsule.

A project link follows the same rule as a library link:

• It publishes the capsules in the project that the project's owner created. Capsules a teammate added to a team project are not included.
• In an organization, a Private capsule is never published, even inside a shared project.
• Encrypted and archived capsules are never published, and neither is a capsule kept out of library links.
• Capsules added to the project later are included when they meet the same rule.

The share dialog tells you how many capsules the link publishes before you create it, and again afterwards. Because adding one of the owner's capsules to a shared project publishes it, adding it needs the right to share that capsule. Adding a teammate's capsule to a shared team project publishes nothing, so it needs nothing extra.

A project is shared by link only. It is never listed publicly, on your profile or on Discover. Setting a project's link sharing does not change who in your organization can open the project: that is still the project's own visibility above. Choosing Private in the share dialog ends every link to the project, and deleting the project ends them too.

To fill a project, use Add capsules on the project's page: search the capsules in the project's workspace, tick the ones you want, and add them. They stay in their types. You can also select capsules on a type's page and choose Add to project.

Moving to a teamCopy Anchor Link

You can bring personal content into an organization you belong to, as a member who can add content there (not a viewer).

• A capsule: choose Move or copy to a team in the capsule's menu, or select several capsules on a type page and choose the same action. Pick the organization, the type the capsules should land in, and whether to Move them or Copy them.
• A project: on a personal project's page, choose Move or copy to a team. Each type in the project is matched to a type in the organization: one with the same name and the same fields when it exists, otherwise a new one created there with the same fields, template and guidance. You can change each match before confirming.

Symbol tells you what will change before anything does. The confirm step says who will be able to see the content, for example "Every member of Acme (12 people) will be able to read and edit this capsule. 2 links to it will keep working." It also names any collections the capsules will leave and anything a share link on the target type would publish. Nothing moves until you confirm.

What a move keeps: the capsule is the same capsule, so its share links, likes, saves, versions, attachments and log entries keep working. It gets a new reference in its new type, and its old @type/N reference and alias keep pointing at it: a capsule of yours that mentioned it still shows a working link, as long as the person reading can see the capsule in the team. Anyone who can't sees the mention as plain text, the same as a mention of a deleted capsule.

What a move changes: the capsule takes the type's sharing level in the team, so with an Org Edit type every member can read and edit it. It leaves any collections of its old type and any personal project (unless you moved the project too). Its storage now counts against the organization. A capsule you listed publicly stops being listed, because team content is never public.

What a copy does: the original stays in your personal library unchanged, and the copy starts fresh in the team with its own reference. Mentions inside the copy resolve against the team's content.

Encrypted capsules can't be moved or copied into a team, because the server can't re-encrypt them for the team's key. Archived capsules and log capsules stay where they are; restore an archived capsule first. When you move a project, any of its capsules that can't go stay in your personal library and leave the project.

MCP Access for OrganizationsCopy Anchor Link

When using an AI assistant (such as Claude via the MCP server), access to shared organization resources requires an extra opt-in step. Each user controls whether their AI assistant can access each organization's shared content via the MCP Access toggle in their account settings.

This is per-organization and per-user. Enabling MCP access for one organization does not affect other organizations. The toggle covers AI assistants, MCP clients and personal API keys. It does not affect the web app or the Symbol mobile app. One known limit: a phone that signed in to the mobile app long ago under a custom device name can count as a personal API key until it signs in again.

The toggle also covers share links: if you turned MCP access off for an organization, your AI assistant can't read a share link to that organization's content either. Share links to anyone else's content work in your assistant whenever the link itself works; no shared organization is needed.

Prompt Safety ClassificationCopy Anchor Link

When you publicly share a capsule whose Type uses the prompt render template, Symbol runs an automated, best-effort safety check on the prompt body. The recipient sees a risk level and a short reason:

• Low: the prompt renders normally.
• Medium: a non-blocking caution appears above the still-visible, still-copyable prompt.
• High: the prompt body and copy controls are withheld until the recipient acknowledges the risk.

Classification runs in the background, is cached per prompt body, and fails open: if the classifier is disabled or unavailable, sharing and viewing still work and the prompt renders ungated. The score is a signal, not a guarantee. A prompt scored safe may still be risky, and vice versa. See the Terms of Use for the full disclaimer.

Quick ReferenceCopy Anchor Link