Roles decide what you can reach across the whole of Pyron. Sharing is the other way in: an administrator can give one person access to a single part of the directory — a site, an area, one item — without changing the roles they hold.
Sharing part of the directory
Most of what you can reach comes from roles, which open pages and controls wherever they apply. Sharing works at a smaller scale. It gives one person access to a single branch of the directory and everything filed under it, and leaves the rest of the tree alone.
An administrator shares a branch from the item itself or from the central access area under Policy. Sharing sets how much the person can do on that branch:
- see the branch and the entries kept on it,
- add new entries,
- change entries that are already there,
- or remove entries and parts of the branch.
Every share includes the ability to see the branch — you cannot give someone the right to change something they cannot open.
An administrator can only share access they already hold themselves, and never more than that. Sharing also never hands over the right to share: deciding who can share a branch stays an administrator's job.
Access flows down the tree
When you share a branch, you share everything beneath it. Share a site and you have shared its areas, its items and every entry kept on them; share a single area and you have shared just that area and what sits inside it. The sharing screen states it plainly: "Sharing always includes everything below it."
You cannot share a branch while holding back part of what sits under it. When a branch is shared, its children — and their children — come with it, all the way down.
This keeps the picture consistent: a person always holds complete branches, never a parent with one of its children hidden inside it. The level of access you choose sits at the point you share and reaches everything below. So to give someone a whole site, share the site; to give them one area within it, share that area instead.
Checking who has access
Once access is spread across roles and shares, it helps to be able to ask two plain questions: what can this person reach, and who can reach this part of the directory? The Access Explorer, under the "Explorer" tab in Policy, answers both.
Pick the "By person" view and choose someone to see everything their access adds up to — the branches and pages they can reach, and where each piece of access comes from. The explorer keeps two things apart: access that an organisation-wide role grants, and anything that has been shared with the person directly. That makes it easy to tell why they can see what they see.
Switch to the "By directory" view to start from the tree instead. Choose a branch, and the explorer shows who can reach it and at what level.
Administrators manage the shares themselves from the sharing screen, and the Access Explorer has the full walkthrough of both views.