ProjectBuild a Permission-Aware Knowledge Hub as an MCP Server: the explanation · Module 7: The access model: groups and visibility · part 9 of 22
Part 9 · Module 7: The access model: groups and visibility
Module 7: The access model: groups and visibility
20 min read·
About 40 minutes · Needs: Module 6 (the seed company and its visibility labels) · Code: server/wayfinder/access.py, server/wayfinder/auth/scopes.py, server/wayfinder/auth/principal.py, server/wayfinder/api/routes.py, console/src/pages/Access.tsx, seed/access.md
Where this fits
This module (blue) is the access rules: how a person's team becomes the groups they may read, and how that differs from the scopes on their tokens.
Before search can filter anything, Wayfinder has to answer two questions about the caller: what may this person see, and what may this person do? This module owns both answers. The first comes from visibility labels and groups, the second from scopes. The permission filtering in Module 10 then pushes the first answer inside every ranked SQL query; Module 12 shows how the second travels inside OAuth tokens.
The rest of this project is yours to keep
This project is bought on its own, once, and stays readable afterwards, including the parts added to it later.