Advanced Permission Control - Permission Funnel & Page Shortcuts

In Kipwise’s permission funnel, a sub-folder can only narrow down who has access, never widen it. Two habits follow from that: set the access of every sensitive sub-folder explicitly when you create it, and check who can open a folder before you add a Page shortcut into it.

How the permission funnel works

You organize content in Kipwise with folders and sub-folders. Permissions are set on the top-level folder, and the permission funnel lets you set them at the sub-folder level too. At the sub-folder level you can only narrow down the list of teammates who have access, not expand it, so nobody unexpected is granted access to the content in a sub-folder.

Why a funnel instead of free sharing

Tools such as Google Drive let you share a sub-folder with teammates who have no access to the parent folder. We think a funnel, where you can only grant access to people who already have access to the parent folder, keeps content more organized, easier to find and safer, for two reasons.

1. No surprise access to sub-folders

With a funnel, the list on the top-level folder tells you everyone who can reach any of its sub-folders. With free sharing, you only find out that someone outside the original list has access by opening every sub-folder, and as sub-folders pile up it is easy to lose track of who can see what.

2. A folder structure everyone sees the same way

Take a top-level folder “Marketing” with three sub-folders, “SEO”, “Social” and “Outbound”. With a funnel, anyone with access to a sub-folder must also have access to “Marketing”, so their sub-folders are grouped neatly under it. With free sharing, someone can have access to “SEO”, “Social” and “Outbound” without access to “Marketing”, so the system can’t group the three under one parent and everyone ends up with a different folder tree.

Levels of access rights

For each teammate or user group you have granted access, there are 5 levels of access rights you can set:

Owner

• Can create subfolders
• Can rename / delete the folder and subfolders
• Can change the permission setting of the folder and subfolders
• Can set up activity feeds in Slack for that folder and subfolders
• And all actions that can be done under the “can review” access right

Can review

• Can approve content in that folder (read more about our content review flow)
• And all actions that can be done under the “can edit” access right

Can edit

• Can edit content in that folder but cannot approve content in that folder. For content that they created, it will automatically be marked as "to be reviewed" and need to be approved by someone who has the reviewer right.
• And all actions that can be done under the “can comment” access right

Can comment

• Can comment on that folder but cannot edit

Can view

• Can view the content but cannot comment

The funnel narrows only the list of teammates who have access. Their level of access can go up at the sub-folder level, because people more often need a higher right, such as owner or edit, on a subset of content than on the entire folder.

For example, you can make the “Marketing” folder accessible to the user group “SEO Team” with read-only rights, and give the “SEO Team” edit rights on the “SEO” sub-folder, so the SEO team can edit content inside “SEO” only, not the entire “Marketing” folder.

Example: the Marketing Director

Say you are the Marketing Director. You created a top-level folder “Marketing” with 4 sub-folders: “Marketing Team Goals and Stats”, “SEO”, “Social Media” and “Marketing Team Performance Review”.

For transparency across teams, you want the whole organization to be able to view the content of some folders, with only the marketing team able to edit it, so that nobody messes up the content. For more sensitive folders such as “Marketing Team Performance Review”, you want to limit access to the marketing managers only. With the permission funnel:

1. For the top-level folder “Marketing”

• Set “Everyone at YourCompany” to “can view” (or “can comment”)
• Set the user group “Marketing Team” to “can edit”
• Set the user group “Marketing Managers” to “can review”

Everyone at your company can view the content inside the folder, but only the marketing team can edit it and only the marketing managers can approve it.

2. For the more sensitive sub-folder “Marketing Team Performance Review”

• Change the access from “Everyone at YourCompany can view” to “Only selected users can view or edit”
• Then set “Marketing Managers” to “can review” (or “edit”)

Only the marketing managers can approve and edit the content in this folder, and everyone else has no access to it.

3. For the sub-folder “SEO”

If your team is big and it is hard to manage everything on your own, grant “owner” rights to your team leaders so they can manage the content in their areas. For the “SEO” sub-folder, for example, grant “owner” rights to the user group “SEO Managers”, so they can create and delete sub-folders under “SEO” and manage its permission settings.

* Because of the funnel, to select “SEO Managers” as a user group on “SEO”, you first have to add this group to the top-level folder “Marketing”. You can set them to “can edit” on “Marketing”, so they have owner rights only on “SEO”, not on the entire “Marketing” folder.

Don’t need to narrow down the access rights? Use the “Follow the permissions of the parent folder” option

For sub-folders where you don’t need to narrow down access, such as “Marketing Team Goals and Stats”, select the option “Follow the permissions of the parent folder”. If you later update the permissions of “Marketing”, the same changes apply to “Marketing Team Goals and Stats” automatically.

For example, if you later grant a new user group, “Social Media Team”, edit rights on “Marketing”, it is added to “Marketing Team Goals and Stats” with edit rights automatically, while it stays without access to the sub-folders (“SEO”, “Social Media” and “Marketing Team Performance Review”) that don’t follow the parent.

We recommend setting the access of every sensitive sub-folder explicitly when you create it, instead of relying on “Follow the permissions of the parent folder”. A sub-folder that follows the parent picks up every group you later add to the parent, so a change meant for one sub-folder can reach a folder you forgot about. Choosing “Only selected users” for the sensitive ones keeps later changes to the parent from widening their access.

Page Shortcuts: sharing the same Page across multiple folders

Some content is useful to several teams. Instead of creating duplicate content, which makes updates hard to manage, you can create a Page Shortcut to share a Page in multiple folders.

For example, for an article “How to handle Sales-to-Customer Success handoff”, first create a Kipwise Page in the Sales folder and then create a Page shortcut in the Customer Success folder. The article then also appears in the Customer Success folder tree, and customer success teammates can access the Page following the permission settings of the Customer Success folder.

We recommend checking who can open the destination folder before you add a shortcut. Because the Page follows the permission settings of the folder it appears in, everyone who can open that folder can open the Page. For a sensitive Page, pick a folder whose audience is no wider than the audience you want.

Read more about How Page Shortcut works.

Options to share certain content with people outside of your organization

To share certain content with people outside your organization, read our blog post Manage internal knowledge efficiently with the feasibility to share content with external parties. It walks you through other functions, such as a public customer-facing knowledge base and trackable public links for sharing a particular piece of content with external parties.